# Security Release for issue 15205

**URL:** <https://discuss.tryton.org/t/security-release-for-issue-15205/9460>\
**Category:** News\
**Tags:** security\
**Created:** [November 6, 2026, 1:00pm UTC](https://discuss.tryton.org/t/security-release-for-issue-15205/9460 "2026-11-06T13:00:39Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)\
**Post date:** [November 6, 2026, 1:00pm UTC](https://discuss.tryton.org/t/security-release-for-issue-15205/9460/1 "2026-11-06T13:00:39Z")

</div>

Clément Mercier using Claude has discovered that [there is no restriction on running wizards without any model or group](https://bugs.tryton.org/15205).

## Impact

[CVSS v3.0 Base Score: 8.1](https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: High
- Availability: None

## Workaround

Add at least one group to the listed wizards in the issue via “Administration / User Interface / Actions / Wizards”.  
This must also be done after the update in order to allow users to execute the said wizards.

## Resolution

All affected users should upgrade `trytond` to the latest version and ensure that no unwanted users have been created on the system.

Affected versions per series:

- `trytond`:
  - 8.2: \<= 8.2.1
  - 8.0: \<= 8.0.12
  - 7.8: \<= 7.8.18
  - 7.0: \<= 7.0.59

Not affected versions per series:

- `trytond`:
  - 8.2: \>= 8.2.2
  - 8.0: \>= 8.0.13
  - 7.8: \>= 7.8.19
  - 7.0: \>= 7.0.60

## Reference

- [https://bugs.tryton.org/15205](https://bugs.tryton.org/15205)

## Concerns?

Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/](https://bugs.tryton.org/) with the confidential checkbox checked.