Odoo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-36259 Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information viHigh 7.5 · Feb 25, 2025
• CVE-2024-12368 Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other useHigh 8.1 · Feb 25, 2025
• CVE-2024-34534 A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain priviHigh 7.3 · May 6, 2024
• CVE-2024-34533 A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a remote attacker to High 7.3 · May 6, 2024
• CVE-2021-45111 Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demHigh 8.1 · Apr 25, 2023
• CVE-2021-44547 A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalatiCritical 9.1 · Apr 25, 2023
• CVE-2021-23203 Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF High 7.5 · Apr 25, 2023
• CVE-2021-23186 A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database conHigh 8.7 · Apr 25, 2023
• CVE-2021-23178 Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized paHigh 7.5 · Apr 25, 2023
• CVE-2021-23166 A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on High 8.7 · Apr 25, 2023
• CVE-2020-29396 A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticatedHigh 8.8 · Dec 22, 2020
• CVE-2019-11781 Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims High 8.8 · Dec 22, 2020
• CVE-2018-15632 Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialCritical 9.1 · Dec 22, 2020
• CVE-2019-11780 Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to High 8.1 · Dec 19, 2019
• CVE-2018-14733 The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service) High 7.5 · Jul 5, 2019
• CVE-2018-14860 Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users Critical 9.1 · Jul 3, 2019
• CVE-2018-14859 Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to rHigh 8.1 · Jul 3, 2019
• CVE-2018-14863 Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call privateHigh 8.1 · Jul 3, 2019
• CVE-2018-14885 Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restoreCritical 9.8 · Jun 28, 2019
• CVE-2018-15640 Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a craftHigh 8.8 · Apr 9, 2019
• CVE-2017-10805 In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows High 8.8 · Jul 4, 2017
• CVE-2017-10804 In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstancCritical 9.8 · Jul 4, 2017