CVE-2024-12368
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
Published Feb 25, 2025 · updated Jun 17, 2026 · odoo odoo
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
Timeline
Detection, updates, and resolution for this record.
Feb 25, 2025 · Catalog
Detected
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
Jun 16, 2026 · Catalog
Updated
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
Jun 17, 2026 · NIST NVD
Updated
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
Affected
- cpe odoo/odoo15.0
Sources
- CVE.orgCVE-2024-12368
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-12368
30-day exploitation probability 0.7%
first.org - NIST NVDCVE-2024-12368
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
nvd.nist.gov - Odoo SecurityCVE-2024-12368
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com