CVE-2018-15645
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrar…
Published Dec 22, 2020 · updated Jun 17, 2026 · odoo odoo
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
Timeline
Detection, updates, and resolution for this record.
Dec 22, 2020 · Catalog
Detected
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
Jun 16, 2026 · Catalog
Updated
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
Jun 17, 2026 · NIST NVD
Updated
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
Affected
- cpe odoo/odooversion unspecified
Sources
- CVE.orgCVE-2018-15645
Official CVE identifier
cve.org - FIRST EPSSCVE-2018-15645
30-day exploitation probability 0.9%
first.org - NIST NVDCVE-2018-15645
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
nvd.nist.gov - Odoo SecurityCVE-2018-15645
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com