# Security release for issue12108
**URL:** https://discuss.tryton.org/t/security-release-for-issue12108/5999
**Category:** News
**Tags:** security
**Created:** [March 7, 2023, 7:00am UTC](https://discuss.tryton.org/t/security-release-for-issue12108/5999 "2023-03-07T07:00:45Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@pokoli](https://discuss.tryton.org/u/pokoli)
#### Post date: [March 7, 2023, 7:00am UTC](https://discuss.tryton.org/t/security-release-for-issue12108/5999/1 "2023-03-07T07:00:45Z")
## Synopsis
A vulnerability in [`trytond`](https://pypi.org/project/trytond/) has been found by José Antonio Díaz Miralles (@tiyujopite).
Due to [issue12108](https://foss.heptapod.net/tryton/tryton/-/issues/12108), the Tryton server does not refresh the authenticated user data but instead uses the values from the first request.
# Resolution
A fix for all supported versions has been released.
Affected versions per supported series:
```auto
trytond:
6.6: <= 6.6.5
6.4: <= 6.4.12
6.0: <= 6.0.28
```
Non affected versions per supported series:
```auto
trytond:
6.6: >= 6.6.6
6.4: >= 6.4.13
6.0: >= 6.0.29
```
We encourage everyone to upgrade the trytond package to latest released version.
## Reference
- [Transaction cache override the current user (#12108) · Issues · Tryton / Tryton · GitLab](https://foss.heptapod.net/tryton/tryton/-/issues/12108)
## Concerns?
Any security concerns should be reported on the bug-tracker at [[Issues · Tryton / Tryton · GitLab](https://foss.heptapod.net/tryton/tryton/-/issues)) marking them as **`confidential`**.
---
### Author:  [@system](https://discuss.tryton.org/u/system)
#### Post date: [April 6, 2023, 7:01am UTC](https://discuss.tryton.org/t/security-release-for-issue12108/5999/2 "2023-04-06T07:01:08Z")
This topic was automatically closed after 30 days. New replies are no longer allowed.