From de1a30881fec80dfa93c4b91f3ae72d6181791ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 30 Jun 2026 09:48:33 +0200
Subject: [PATCH] Enforce access right on the email template record

Closes #14907
(grafted from d9aa2de5dabe7e39892c41808d56103ea83bf95f)

--HG--
branch : 8.0
---
 trytond/CHANGELOG            | 1 +
 trytond/trytond/ir/email_.py | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index 5b4280f44a..3317ef12af 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Enforce access right on the email template record (issue14907)
 * Add ModelAccessProxy (issue14907)
 * Restrict Genshi evaluation (issue14869, issue5160)
 
diff --git a/trytond/trytond/ir/email_.py b/trytond/trytond/ir/email_.py
index b792431475..d60a35f49b 100644
--- a/trytond/trytond/ir/email_.py
+++ b/trytond/trytond/ir/email_.py
@@ -10,7 +10,8 @@ from genshi.template import TextTemplate
 
 import trytond.config as config
 from trytond.i18n import gettext
-from trytond.model import EvalEnvironment, ModelSQL, ModelView, fields
+from trytond.model import (
+    EvalEnvironment, ModelAccessProxy, ModelSQL, ModelView, fields)
 from trytond.model.exceptions import AccessError, ValidationError
 from trytond.pool import Pool
 from trytond.pyson import Bool, Eval, PYSONDecoder
@@ -400,7 +401,7 @@ class EmailTemplate(ModelSQL, ModelView):
     def get(self, record):
         pool = Pool()
         Model = pool.get(self.model.name)
-        record = Model(int(record))
+        record = ModelAccessProxy(Model(int(record)))
 
         values = {}
         for attr, key in [