Clément Mercier using Claude has discovered that there is no restriction on running wizards without any model or group.ImpactCVSS v3.0 Base Score: 8.1Attack Vector: NetworkAttack Complexity: LowPrivileges Required: LowUser Interaction: NoneScope: UnchangedConfidentiality: HighIntegrity: HighAvailability: NoneWorkaroundAdd at least one group to the listed wizards in the issue via “Administration / User Interface / Actions / Wizards”.This must also be done after the update in order to allow users to execute the said wizards.ResolutionAll affected users should upgrade trytond to the latest version and ensure that no unwanted users have been created on the system.Affected versions per series:trytond:8.2: = 7.0.60Referencehttps://bugs.tryton.org/15205Concerns?Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the confidential checkbox checked. 1 post - 1 participant Read full topic