# Security Release for issue7766

**URL:** https://discuss.tryton.org/t/security-release-for-issue7766/861
**Category:** News
**Tags:** security
**Created:** [November 12, 2018, 10:25pm UTC](https://discuss.tryton.org/t/security-release-for-issue7766/861 "2018-11-12T22:25:00Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [November 12, 2018, 10:25pm UTC](https://discuss.tryton.org/t/security-release-for-issue7766/861/1 "2018-11-12T22:25:00Z")

</div>

## Synopsis

A vulnerability in [trytond](https://pypi.org/project/trytond/), the core package of Tryton, has been found by [Cédric Krier](https://bugs.tryton.org/user3).  
The [issue7766](https://bugs.tryton.org/issue7766) shows that it is possible for an authenticated user to guess the value of a field for which he has no access right no matter if it is at the model or the field level. The procedure is to make dichotomous search queries on the model using a domain clause on the field equals value until the search returns the id.

## Impact

[CVSS v3.0 Base Score: 6.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: None
- Availability: None

## Workaround

There are no known workarounds.

## Resolution

All affected users should upgrade `trytond` to the latest version.  
Affected versions per series:

- 5.0: \<=5.0.0
- 4.8: \<=4.8.4
- 4.6: \<=4.6.8
- 4.4: \<=4.4.13
- 4.2: \<=4.2.15
- 4.0: \<=4.0.19

Non affected versions per series:

- 5.0: \>=5.0.1
- 4.8: \>=4.8.5
- 4.6: \>=4.6.9
- 4.4: \>=4.4.14
- 4.2: \>=4.2.16
- 4.0: \>=4.0.20

## Reference

- [issue7766](https://bugs.tryton.org/issue7766)

## Concern?

Any security concerns should be reported on the bug-tracker at  
[https://bugs.tryton.org/](https://bugs.tryton.org/) with the type `security` .

## Remarks

The module `stock_supply` received a fix that break the policy of not XML data changes in series. This is to give read access to “Stock Administrator” group for purchase requests in order to run the supply wizard without error.