CVE-2025-66424: Tryton Trytond Auth Bypass Vulnerability

CVE-2025-66424 Overview

CVE-2025-66424 is a missing authorization vulnerability in Tryton trytond, the server component of the Tryton business application platform. The flaw allows authenticated users to export data without the server enforcing the access rights that normally govern record visibility. Affected versions include trytond 6.0 through releases prior to 7.6.11, with fixes delivered in 7.6.11, 7.4.21, 7.0.40, and 6.0.70. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact
An authenticated low-privilege user can export records they would otherwise not be permitted to read, resulting in confidentiality loss across ERP, accounting, and HR data managed by Tryton.

Affected Products

Tryton trytond 6.0 series before 6.0.70
Tryton trytond 7.0 series before 7.0.40 and 7.4 series before 7.4.21
Tryton trytond 7.6 series before 7.6.11

Discovery Timeline

2025-11-30 - CVE-2025-66424 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2025-66424

Vulnerability Analysis

Tryton trytond exposes a generic data export mechanism that lets users serialize model records to formats such as CSV. The export code path does not evaluate the model and field access rules that the standard read path enforces. As a result, any authenticated user with export capability can request records whose model access rights, record rules, or field permissions should block visibility.

The outcome is a one-way confidentiality exposure. Integrity and availability are not affected because export is read-only, but the exported data may include financial, personal, or operational records that policy restricts to specific groups. The issue is remotely exploitable over the network by any session-bound user with low privileges and no user interaction.

Root Cause

The root cause is incomplete authorization enforcement in the export handler. Access rights that gate standard read operations were not applied to the export entry point, leaving a parallel data retrieval path uncovered by the model's access control checks.

Attack Vector

Exploitation requires valid credentials to a Tryton server reachable over the network. The attacker invokes the export action against a model containing restricted data and receives the serialized records in the response. See the Tryton security release discussion and Heptapod issue #14366 for upstream details.

Detection Methods for CVE-2025-66424

Indicators of Compromise

Unexpected export requests in trytond server logs targeting models the requesting user has no business reason to access.
Large or repeated CSV/JSON export responses to accounts that historically perform only interactive reads.
Export activity originating from service or integration accounts outside normal batch windows.

Detection Strategies

Review trytond application logs for calls to the export_data RPC method and correlate the invoking user against the model being exported.
Baseline per-user export volume and alert on deviations, especially where the user's group lacks matching read rights in Tryton's access control configuration.
Compare pre-upgrade and post-upgrade export audit trails to identify historical misuse that predated the patch.

Monitoring Recommendations

Forward trytond logs and reverse-proxy access logs to a central SIEM for retention and correlation.
Enable database-level auditing on sensitive models (parties, invoices, salaries) to confirm whether unauthorized reads occurred via export.
Alert on anomalous spikes in response size from the Tryton RPC endpoint tied to a single session.

How to Mitigate CVE-2025-66424

Immediate Actions Required

Upgrade trytond to 7.6.11, 7.4.21, 7.0.40, or 6.0.70 depending on the deployed branch.
Audit user and group assignments to confirm that export-capable roles are limited to trusted personnel.
Rotate credentials for any account suspected of abusing the export path prior to patching.

Patch Information

Upstream maintainers released fixed packages across all supported branches. Install the corresponding version using the standard package manager (pip install --upgrade trytond==7.6.11 or the equivalent for your branch) and restart the trytond service. Confirm patch adoption via the Tryton security release discussion.

Workarounds

Restrict the export action at the group level in Tryton administration until patched versions are deployed.
Place the Tryton RPC endpoint behind a reverse proxy that denies the model.*.export_data method for untrusted roles.
Enforce network-level allowlisting so that only known operator subnets can reach the trytond service.

bash

# Upgrade example for a pip-managed deployment
pip install --upgrade "trytond==7.6.11"
systemctl restart trytond