CVE-2019-10868: Vulnerability in trytond
Summary
CVE-2019-10868: In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no ac... Affects trytond across 5 version ranges.
>= 4.2.0, < 4.2.21
>= 4.4.0, < 4.4.19
>= 4.6.0, < 4.6.14
>= 4.8.0, < 4.8.10
>= 5.0.0, < 5.0.6
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tryton-server · Debian:11
The same CVE-2019-10868 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tryton is an open-source business application platform written in Python. It provides a set of modules for managing various business processes. The vulnerability affects versions 4.2 to 4.2.21, 4.4 to 4.4.19, 4.6 to 4.6.14, 4.8 to 4.8.10, and 5.0 to 5.0.6 of the trytond package available on PyPI. Tryton allows authenticated users to order records based on a field for which they have no access rights. This can potentially enable users to guess values and gain unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in trytond allows authenticated users to order records based on a field for which they have no access rights. By exploiting this vulnerability, an attacker can potentially guess values and gain unauthorized access to sensitive information. This can lead to data breaches, unauthorized modifications, or other malicious activities depending on the specific use case of the affected application.
How To Fix
Latest published version: 8.2.1 as of 22 Oct 2026
pip install --upgrade "trytond==8.2.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.214.2.21pip install --upgrade "trytond==4.2.21" -
>= 4.4.0, < 4.4.194.4.19pip install --upgrade "trytond==4.4.19" -
>= 4.6.0, < 4.6.144.6.14pip install --upgrade "trytond==4.6.14" -
>= 4.8.0, < 4.8.104.8.10pip install --upgrade "trytond==4.8.10" -
>= 5.0.0, < 5.0.65.0.6pip install --upgrade "trytond==5.0.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to the patched version of trytond.
Conclusion
The vulnerability in trytond allows authenticated users to order records based on a field for which they have no access rights. Upgrading to the latest patched version of trytond is the recommended solution to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for trytond →
FAQ
The vulnerability allows authenticated users to order records based on a field for which they have no access rights. This can potentially lead to unauthorized access to sensitive information and other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the patched version of trytond.
Yes, versions 4.2 to 4.2.21, 4.4 to 4.4.19, 4.6 to 4.6.14, 4.8 to 4.8.10, and 5.0 to 5.0.6 of trytond are affected by this vulnerability.
You can find more information about this vulnerability in the Tryton advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/trytond/PYSEC-2019-127.yaml
Related vulnerabilities
Recent vulnerabilities recorded for trytond.
