CVE-2021-44465

Published: Apr 25, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests.

Affected (2)

Products: Odoo: Odoo

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Odoo Odoo	Up to 13.0
Odoo Odoo	Up to 13.0

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://github.com/odoo/odoo/issues/107692

Source: security@odoo.com

Issue TrackingPatchVendor Advisory

https://github.com/odoo/odoo/issues/107692

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

Timeline

No history available yet.