Improper Access Control in Odoo Community and Enterprise Products by Odoo

CVE-2021-44465

What is CVE-2021-44465?

In Odoo Community and Enterprise versions 13.0 and earlier, an improper access control vulnerability permits authenticated attackers to exploit the system by subscribing to notifications related to arbitrary business records. This can be achieved through specially crafted RPC requests, allowing unauthorized visibility into sensitive data and communications within the application.

References