CVE-2018-14868
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other use…
Published Jun 28, 2019 · updated Jun 17, 2026 · odoo odoo
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.
Timeline
Detection, updates, and resolution for this record.
Jun 28, 2019 · Catalog
Detected
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.
Jun 16, 2026 · Catalog
Updated
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.
Jun 17, 2026 · NIST NVD
Updated
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.
Affected
- cpe odoo/odoo9.0
Sources
- CVE.orgCVE-2018-14868
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-14868
30-day exploitation probability 0.6%
first.org - NIST NVDCVE-2018-14868
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.
nvd.nist.gov - Odoo SecurityCVE-2018-14868
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com