CVE-2018-14862
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to d…
Published Jul 3, 2019 · updated Jun 17, 2026 · odoo odoo
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
Timeline
Detection, updates, and resolution for this record.
Jul 3, 2019 · Catalog
Detected
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
Jun 16, 2026 · Catalog
Updated
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
Jun 17, 2026 · NIST NVD
Updated
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
Affected
- cpe odoo/odoo10.0
- cpe odoo/odoo11.0
- cpe odoo/odoo9.0
Sources
- CVE.orgCVE-2018-14862
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-14862
30-day exploitation probability 0.8%
first.org - NIST NVDCVE-2018-14862
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
nvd.nist.gov - Odoo SecurityCVE-2018-14862
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com