# Security Release for issues #13505 and #13506

**URL:** <https://discuss.tryton.org/t/security-release-for-issues-13505-and-13506/7846>\
**Category:** News\
**Tags:** security\
**Created:** [September 17, 2024, 6:00am UTC](https://discuss.tryton.org/t/security-release-for-issues-13505-and-13506/7846 "2024-09-17T06:00:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)\
**Post date:** [September 17, 2024, 6:00am UTC](https://discuss.tryton.org/t/security-release-for-issues-13505-and-13506/7846/1 "2024-09-17T06:00:29Z")

</div>

[Albert Cervera](https://foss.heptapod.net/albertca) has found that [trytond](https://pypi.org/project/trytond/) allows to execute reports [for records that user has no read access](https://bugs.tryton.org/13505) and also [for reports limited to a set of group that the user is not](https://bugs.tryton.org/13506).

## Impact

[CVSS v3.0 Base Score: 4.3](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C/CR:L/MAV:N/MAC:L/MPR:L/MUI:N/MS:U/MC:L/MI:N/MA:N)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality: Low
- Integrity: None
- Availability: None

## Workaround

There is no known workaround.

## Resolution

All affected users should upgrade `trytond` to the latest version.

Affected versions per series:

- `trytond`:
  - 7.2: \<= 7.2.8
  - 7.0: \<= 7.0.17
  - 6.0: \<= 6.0.51

Non affected versions per series:

- `trytond`:
  - 7.2: \>= 7.2.9
  - 7.0: \>= 7.0.18
  - 6.0: \>= 6.0.52

## Reference

- [Access to records of report are not checked (#13505) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/13505)
- [get\_groups does not always returns the group of the action (#13506) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/13506)

## Concerns?

Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/](https://bugs.tryton.org/) with the confidential checkbox checked.

---

<div class="post-metadata">

**Author:** ![system](https://discuss-cdn.tryton.org/uploads/default/original/1X/c6f8ec0a40525cdcd50058c734283450a4b3d38b.png) [@system](https://discuss.tryton.org/u/system)\
**Post date:** [October 17, 2024, 6:02am UTC](https://discuss.tryton.org/t/security-release-for-issues-13505-and-13506/7846/2 "2024-10-17T06:02:06Z")

</div>

This topic was automatically closed after 30 days. New replies are no longer allowed.