diff --git a/CHANGELOG b/CHANGELOG
index 7b4e074f46..127e72bca6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Don't allow rpc call on ModelStorage without ModelView (CVE-2012-0215)
 * Add shared WebDAV
 * Remove workflow module
 * Simplify workflow engine
diff --git a/trytond/model/modelstorage.py b/trytond/model/modelstorage.py
index 9b2fd91133..312afa3bb6 100644
--- a/trytond/model/modelstorage.py
+++ b/trytond/model/modelstorage.py
@@ -26,6 +26,7 @@ from trytond.transaction import Transaction
 from trytond.pool import Pool
 from trytond.cache import LRUDict
 from trytond.config import CONFIG
+from .modelview import ModelView
 
 
 class ModelStorage(Model):
@@ -42,18 +43,19 @@ class ModelStorage(Model):
 
     def __init__(self):
         super(ModelStorage, self).__init__()
-        self._rpc.update({
-            'create': True,
-            'read': False,
-            'write': True,
-            'delete': True,
-            'copy': True,
-            'search': False,
-            'search_count': False,
-            'search_read': False,
-            'export_data': False,
-            'import_data': True,
-        })
+        if isinstance(self, ModelView):
+            self._rpc.update({
+                'create': True,
+                'read': False,
+                'write': True,
+                'delete': True,
+                'copy': True,
+                'search': False,
+                'search_count': False,
+                'search_read': False,
+                'export_data': False,
+                'import_data': True,
+            })
         self._constraints = []
 
     def default_create_uid(self):