From 2e84b60e759e3a016c8012a35302c2de6009af31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 30 Jun 2026 09:48:33 +0200
Subject: [PATCH] Enforce access right on the email template record

Closes #14907
---
 trytond/CHANGELOG            | 1 +
 trytond/trytond/ir/email_.py | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index 7b8b0c0a74..528440efc6 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Enforce access right on the email template record (issue14907)
 * Add ModelAccessProxy (issue14907)
 * Restrict Genshi evaluation (issue14869, issue5160)
 * Add BrowseList for Model instances
diff --git a/trytond/trytond/ir/email_.py b/trytond/trytond/ir/email_.py
index b792431475..d60a35f49b 100644
--- a/trytond/trytond/ir/email_.py
+++ b/trytond/trytond/ir/email_.py
@@ -10,7 +10,8 @@ from genshi.template import TextTemplate
 
 import trytond.config as config
 from trytond.i18n import gettext
-from trytond.model import EvalEnvironment, ModelSQL, ModelView, fields
+from trytond.model import (
+    EvalEnvironment, ModelAccessProxy, ModelSQL, ModelView, fields)
 from trytond.model.exceptions import AccessError, ValidationError
 from trytond.pool import Pool
 from trytond.pyson import Bool, Eval, PYSONDecoder
@@ -400,7 +401,7 @@ class EmailTemplate(ModelSQL, ModelView):
     def get(self, record):
         pool = Pool()
         Model = pool.get(self.model.name)
-        record = Model(int(record))
+        record = ModelAccessProxy(Model(int(record)))
 
         values = {}
         for attr, key in [