CVE-2021-44465

MEDIUM

Odoo < 13.0 - Authenticated Improper Access Control via RPC Requests

Title source: llm

Description

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests.

References (1)

Core 1

Core References

Issue Tracking, Patch, Vendor Advisory

https://github.com/odoo/odoo/issues/107692

Scores

CVSS v3 4.3

EPSS 0.0046

EPSS Percentile 36.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284 CWE-863

Status published

Products (1)

odoo/odoo < 13.0 (2 CPE variants)

Published Apr 25, 2023

Tracked Since Feb 18, 2026