Community 12.0+ (auto-extends to new majors such as 20.0). Only confirmed, CVE-linked Community disclosures are shown here. Diff-based security-fix candidates and Enterprise analysis stay internal for research — never published as vulnerabilities on their own.
Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting jou…
Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim.
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the de…
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests.
[IMP] web: StaticList: support CLEAR (5) orm command Before this commit, the StaticList didn't expose a way to apply a CLEAR command (command 5), i.e.
[IMP] web: StaticList: support CLEAR (5) orm command Before this commit, the StaticList didn't expose a way to apply a CLEAR command (command 5), i.e. to empty the relation. This commit adds a function to do so, and adds the support of the CLEAR command in…
[IMP] web: StaticList: support SET (6) orm command · modules: web · Potential XSS correction
[IMP] web: StaticList: support SET (6) orm command
Before this commit, `_applyCommands` didn't support SET command
(command 6). As a consequence, this command had to be special-cased
in `_preprocessX2manyChanges`, and in an override of `Record` in
the ai_fields addon [1].
With this commit, the SET command is now supported in
`_applyCommands`, and a `set()` function has been added on
StaticList for convenience.
Note: since [2], onchange no longer returns SET commands (it only
returns commands from 0 to 4). So this commit adapts a historical
test that still simulated an onchange returning a SET command as
first command.
No task, but followup of [3]
[1] https://github.com/odoo-dev/enterprise/blob/366f0376644d4aecd239378782d2db896ea7bf9f/ai_fields/static/src/model/relational_model/record.js#L26
[2] https://github.com/odoo/odoo/pull/119510
[3] https://github.com/odoo/enterprise/pull/830…
[IMP] web: StaticList: support CLEAR (5) orm command
Before this commit, the StaticList didn't expose a way to apply
a CLEAR command (command 5), i.e. to empty the relation. This
commit adds a `clear()` function to do so, and adds the support of
the CLEAR command in `_applyCommands`.
Note: since [1], onchange no longer returns CLEAR commands (it only
returns commands from 0 to 4). So this commit adapts a few historical
tests that still simulated onchanges returning a CLEAR command as
first command.
Request for task~5350021
[1] https://github.com/odoo/odoo/pull/119510
Part-of: odoo/odoo#249054
Related: odoo/enterprise#107694
Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary…
Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports…
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents o…
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents of other tenants, in a multi-tenant system.
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment m…
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged inst…
Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated u…
Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets.
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users…
A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.
No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.
Confirmed Community Git disclosures
Quoted commit messages that cite a catalog CVE. Cross-branch equivalents (17.0 / 18.0 / 19.0+) are grouped by Change-Id, CVE, and changed symbols when known. Unpublished fix candidates are not listed.
5 Community Git rows.
Feb 16, 2026 · Potential XSS correction · Confirmed reference
[IMP] web: StaticList: support SET (6) orm command
Modules: web
[IMP] web: StaticList: support SET (6) orm command
Before this commit, `_applyCommands` didn't support SET command
(command 6). As a consequence, this command had to be special-cased
in `_preprocessX2manyChanges`, and in an override of `Record` in
the ai_fields addon [1].
With this commit, the SET command is now supported in
`_applyCommands`, and a `set()` function has been added on
StaticList for convenience.
Note: since [2], onchange no longer returns SET commands (it only
returns commands from 0 to 4). So this commit adapts a historical
test that still simulated an onchange returning a SET command as
first command.
No task, but followup of [3]
[1] https://github.com/odoo-dev/enterprise/blob/366f0376644d4aecd239378782d2db896ea7bf9f/ai_fields/static/src/model/relational_model/record.js#L26
[2] https://github.com/odoo/odoo/pull/119510
[3] https://github.com/odoo/enterprise/pull/830…
[IMP] web: StaticList: support CLEAR (5) orm command
Modules: web
[IMP] web: StaticList: support CLEAR (5) orm command
Before this commit, the StaticList didn't expose a way to apply
a CLEAR command (command 5), i.e. to empty the relation. This
commit adds a `clear()` function to do so, and adds the support of
the CLEAR command in `_applyCommands`.
Note: since [1], onchange no longer returns CLEAR commands (it only
returns commands from 0 to 4). So this commit adapts a few historical
tests that still simulated onchanges returning a CLEAR command as
first command.
Request for task~5350021
[1] https://github.com/odoo/odoo/pull/119510
Part-of: odoo/odoo#249054
Related: odoo/enterprise#107694
[REF] web_tour: prepare to change the default action in tour_compiler
Currently, in tour_compiler, to check that an element is actually
present in the DOM in a step, there are 2 possibilities.
- `isCheck: true` => Checks that the element is in the DOM.
The latter can be disabled.
- `run() {}` => Checks that the element is in the DOM (because this
is what is done by default). However, if the element is disabled,
the step will be aborted.
In the codebase, we can see a lot of `run() {} //it's a check` and
`isCheck:true`. However, the behavior is not exactly the same.
What's more, there are 2 ways to do "the same thing".
In order to clarify the turns API, it was decided to no longer put an
action (step.run) by default. (Previously, the default action was
the "click" action).
From then on, it is no longer necessary to stipulate
`step.isCheck: true` nor `run() {}`.
The corollary is that now…
[IMP] payment stripe: migrate to a direct payment flow
Modules: payment, payment_stripe, sale
[IMP] payment stripe: migrate to a direct payment flow
The Reserve Bank of India (RBI) issued a directive (amended subsequently
in December 2020 and March 2021) that introduces additional security
measures for recurring payments on India-issued cards. These measures
include:
- Banks must register cardholders and create an e-mandate through a
one-time process, using additional factor authentication (AFA)
like 3D Secure (3DS).
- Banks must alert cardholders at least 24 hours before charges take
place and give them the ability to opt out of transactions.
- Recurring transactions over 15,000 INR (or equivalent in other
currencies) must go through AFA each time.
Stripe has worked with a partner platform to support that, but we must
manipulate the PaymentIntent and SetupIntent objects directly through
their dedicated API, which the Checkout API does not allow. Therefore,
we must now…
[FIX] reqs: bump up recommended `requests` version
[FIX] reqs: bump up recommended `requests` version
In light of CVE-2018-18074, using python-requests 2.20.0 is recommended,
or any distribution-specific version that was patched.
See also https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074
Hourly ingest discovers new Community/Enterprise N.0 branches, classifies commits from messages and code diffs (access rights, record rules, controllers, sudo(), SQL construction, HTML escaping), correlates backports across majors, and publishes only Community extracts tied to confirmed CVEs. Diff-only candidates remain internal. Enterprise stays authorization-gated — no proprietary diffs, invented CVEs, or exploit steps.
