Listen to this Post
How the CVE Works:
The vulnerability exists in the Tryton server (trytond) where the data export functionality fails to validate a user’s access rights. When an authenticated user, even with minimal base permissions, initiates a request to export records (e.g., via a crafted HTTP request to the `/database/model/export` endpoint), the server does not apply the proper access control rules (like `model.access` or export_access). This allows the user to bypass business-level permission checks and export sensitive data from any model they know the name of, such as `party.party` or account.invoice, leading to a full data breach. The flaw is in the export mechanism’s logic, which retrieves and serializes data before applying any read-right validation.
DailyCVE Form:
Platform: Tryton trytond
Version: 6.0 to 7.6.10
Vulnerability: Improper Access Control
Severity: Critical
Date: 11/29/2025
Prediction: Patch Expected 12/10/2025
What Undercode Say:
Analytics:
curl -X POST -H "Content-Type: application/json" -d '{"model": "party.party", "fields": ["name", "email"]}' http://tryton-server:8000/database/model/export
Check for missing export permission decorator
if not hasattr(model.<strong>class</strong>, '_export_access'):
print("VULNERABLE: No export access control")
How Exploit:
An attacker with a standard user account crafts a direct API call or manipulates the client-side export feature to specify a protected model. The server processes the export request without checking if the user has the ‘read’ permission for that specific model’s records, resulting in the generation and download of a data file (e.g., CSV, JSON) containing all sensitive entries.
Protection from this CVE:
Upgrade to patched versions: 7.6.11, 7.4.21, 7.0.40, or 6.0.70. Implement mandatory server-side access control checks for all export operations, ensuring they respect the defined `export_access` rules and model-level read permissions before any data retrieval.
Impact:
Massive data exfiltration, complete loss of confidentiality for all business data stored in the Tryton system, including personal identifiable information (PII), financial records, and trade secrets, leading to regulatory penalties and reputational damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
