Description
Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.
References (1)
Core 1
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/odoo/odoo/issues/32509
Scores
CVSS v3
4.3
EPSS
0.0026
EPSS Percentile
49.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-732
Status
published
Products (3)
odoo/odoo
9.0 (2 CPE variants)
odoo/odoo
10.0 (2 CPE variants)
odoo/odoo
11.0 (2 CPE variants)
Published
Jul 03, 2019
Tracked Since
Feb 18, 2026