model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.
| Software | From | Fixed in |
|---|---|---|
| tryton / trytond | 3.2.0 | 3.2.10 |
| tryton / trytond | 3.4.0 | 3.4.8 |
| tryton / trytond | 3.6.0 | 3.6.5 |
| tryton / trytond | 3.8.0 | 3.8.1 |
| debian / debian_linux | 8.0 | 8.0.x |