CVE-2021-44460

Published: Apr 25, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests.

Affected (2)

Products: Odoo: Odoo

Odoo

1 product

Odoo

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Odoo Odoo	Up to 13.0
Odoo Odoo	Up to 13.0

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://github.com/odoo/odoo/issues/107685

Source: security@odoo.com

Issue TrackingPatchVendor Advisory

https://github.com/odoo/odoo/issues/107685

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

Timeline

No history available yet.