CVE-2018-14867
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on beh…
Published Jun 28, 2019 · updated Jun 17, 2026 · odoo odoo
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Timeline
Detection, updates, and resolution for this record.
Jun 28, 2019 · Catalog
Detected
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Jun 16, 2026 · Catalog
Updated
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Jun 17, 2026 · NIST NVD
Updated
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Affected
- cpe odoo/odoo10.0
- cpe odoo/odoo9.0
Sources
- CVE.orgCVE-2018-14867
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-14867
30-day exploitation probability 1.4%
first.org - NIST NVDCVE-2018-14867
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
nvd.nist.gov - Odoo SecurityCVE-2018-14867
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com