CVE-2021-23203
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports…
Published Apr 25, 2023 · updated Jun 17, 2026 · odoo odoo
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
Timeline
Detection, updates, and resolution for this record.
Apr 25, 2023 · Catalog
Detected
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
Jun 16, 2026 · Catalog
Updated
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
Jun 17, 2026 · NIST NVD
Updated
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
Affected
- cpe odoo/odoo14.0
- cpe odoo/odoo15.0
Sources
- CVE.orgCVE-2021-23203
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-23203
30-day exploitation probability 0.9%
first.org - NIST NVDCVE-2021-23203
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
nvd.nist.gov - Odoo SecurityCVE-2021-23203
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com