CVE-2024-12368

Published: Feb 25, 2025Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.

Affected (2)

Products: Odoo: Odoo

Odoo

1 product

Odoo

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Odoo Odoo	Version 15.0
Odoo Odoo	Version 15.0

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (1)

https://github.com/odoo/odoo/issues/193854

Source: security@odoo.com

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.