Community 12.0+ (auto-extends to new majors such as 20.0). Only confirmed, CVE-linked Community disclosures are shown here. Diff-based security-fix candidates and Enterprise analysis stay internal for research — never published as vulnerabilities on their own.
[REF] web_tour: prepare to change the default action in tour_compiler Currently, in tour_compiler, to check that an element is actually present in the DOM in a step, t…
[REF] web_tour: prepare to change the default action in tour_compiler Currently, in tour_compiler, to check that an element is actually present in the DOM in a step, there are 2 possibilities. - => Checks that the element is in the DOM. The latter can be di…
[REF] web_tour: prepare to change the default action in tour_compiler · modules: account, mail, point_of_sale, pos_hr, pos_restaurant, pos_self_order · Potential XSS correction
[REF] web_tour: prepare to change the default action in tour_compiler
Currently, in tour_compiler, to check that an element is actually
present in the DOM in a step, there are 2 possibilities.
- `isCheck: true` => Checks that the element is in the DOM.
The latter can be disabled.
- `run() {}` => Checks that the element is in the DOM (because this
is what is done by default). However, if the element is disabled,
the step will be aborted.
In the codebase, we can see a lot of `run() {} //it's a check` and
`isCheck:true`. However, the behavior is not exactly the same.
What's more, there are 2 ways to do "the same thing".
In order to clarify the turns API, it was decided to no longer put an
action (step.run) by default. (Previously, the default action was
the "click" action).
From then on, it is no longer necessary to stipulate
`step.isCheck: true` nor `run() {}`.
The corollary is that now…
Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain…
Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscri…
Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to ob…
Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to.
Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to…
Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to subscribe to arbitrary mail channels uninvited.
Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to…
Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation.
[PERF] account, l10n_*: Improve batch send and print performances Problem --------- When doing the Send & Print on one invoice, or when multiple invoices are selected…
[PERF] account, l10n_*: Improve batch send and print performances Problem --------- When doing the Send & Print on one invoice, or when multiple invoices are selected and the "Download" option is ticked, the PDF generation of the invoices is made synchronou…
[PERF] account, l10n_*: Improve batch send and print performances · modules: account, account_edi_ubl_cii, l10n_es_edi_facturae, l10n_it_edi, l10n_th, base · Access control
[PERF] account, l10n_*: Improve batch send and print performances
Problem
---------
When doing the Send & Print on one invoice, or when multiple invoices
are selected and the "Download" option is ticked, the PDF generation of
the invoices is made synchronously. Generating a simple invoice takes
~2 seconds.
When you're doing the mass Send&Print for 10+ invoices, you can have
your screen loading for >20seconds just to get 10+pages of PDF.
Objective
---------
Start digging into that part to see if optimisation can be done to
reduce that loading time for UX improvements.
Solution
---------
Rather than calling wkhtmltopdf once per invoice, we allow the creation
of all invoices' PDF together through one single call to the library.
The PDF containing all the invoices will then be split and return as a
dictionary. To do so we decoupled the `_render_qweb_pdf` function:
- `_render_qweb_pdf` r…
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrar…
Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.
Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to…
Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attribu…
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary we…
Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted channel names.
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject ar…
Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via a crafted link.
No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.
Confirmed Community Git disclosures
Quoted commit messages that cite a catalog CVE. Cross-branch equivalents (17.0 / 18.0 / 19.0+) are grouped by Change-Id, CVE, and changed symbols when known. Unpublished fix candidates are not listed.
5 Community Git rows.
Feb 16, 2026 · Potential XSS correction · Confirmed reference
[IMP] web: StaticList: support SET (6) orm command
Modules: web
[IMP] web: StaticList: support SET (6) orm command
Before this commit, `_applyCommands` didn't support SET command
(command 6). As a consequence, this command had to be special-cased
in `_preprocessX2manyChanges`, and in an override of `Record` in
the ai_fields addon [1].
With this commit, the SET command is now supported in
`_applyCommands`, and a `set()` function has been added on
StaticList for convenience.
Note: since [2], onchange no longer returns SET commands (it only
returns commands from 0 to 4). So this commit adapts a historical
test that still simulated an onchange returning a SET command as
first command.
No task, but followup of [3]
[1] https://github.com/odoo-dev/enterprise/blob/366f0376644d4aecd239378782d2db896ea7bf9f/ai_fields/static/src/model/relational_model/record.js#L26
[2] https://github.com/odoo/odoo/pull/119510
[3] https://github.com/odoo/enterprise/pull/830…
[IMP] web: StaticList: support CLEAR (5) orm command
Modules: web
[IMP] web: StaticList: support CLEAR (5) orm command
Before this commit, the StaticList didn't expose a way to apply
a CLEAR command (command 5), i.e. to empty the relation. This
commit adds a `clear()` function to do so, and adds the support of
the CLEAR command in `_applyCommands`.
Note: since [1], onchange no longer returns CLEAR commands (it only
returns commands from 0 to 4). So this commit adapts a few historical
tests that still simulated onchanges returning a CLEAR command as
first command.
Request for task~5350021
[1] https://github.com/odoo/odoo/pull/119510
Part-of: odoo/odoo#249054
Related: odoo/enterprise#107694
[REF] web_tour: prepare to change the default action in tour_compiler
Currently, in tour_compiler, to check that an element is actually
present in the DOM in a step, there are 2 possibilities.
- `isCheck: true` => Checks that the element is in the DOM.
The latter can be disabled.
- `run() {}` => Checks that the element is in the DOM (because this
is what is done by default). However, if the element is disabled,
the step will be aborted.
In the codebase, we can see a lot of `run() {} //it's a check` and
`isCheck:true`. However, the behavior is not exactly the same.
What's more, there are 2 ways to do "the same thing".
In order to clarify the turns API, it was decided to no longer put an
action (step.run) by default. (Previously, the default action was
the "click" action).
From then on, it is no longer necessary to stipulate
`step.isCheck: true` nor `run() {}`.
The corollary is that now…
[IMP] payment stripe: migrate to a direct payment flow
Modules: payment, payment_stripe, sale
[IMP] payment stripe: migrate to a direct payment flow
The Reserve Bank of India (RBI) issued a directive (amended subsequently
in December 2020 and March 2021) that introduces additional security
measures for recurring payments on India-issued cards. These measures
include:
- Banks must register cardholders and create an e-mandate through a
one-time process, using additional factor authentication (AFA)
like 3D Secure (3DS).
- Banks must alert cardholders at least 24 hours before charges take
place and give them the ability to opt out of transactions.
- Recurring transactions over 15,000 INR (or equivalent in other
currencies) must go through AFA each time.
Stripe has worked with a partner platform to support that, but we must
manipulate the PaymentIntent and SetupIntent objects directly through
their dedicated API, which the Checkout API does not allow. Therefore,
we must now…
[FIX] reqs: bump up recommended `requests` version
[FIX] reqs: bump up recommended `requests` version
In light of CVE-2018-18074, using python-requests 2.20.0 is recommended,
or any distribution-specific version that was patched.
See also https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074
Hourly ingest discovers new Community/Enterprise N.0 branches, classifies commits from messages and code diffs (access rights, record rules, controllers, sudo(), SQL construction, HTML escaping), correlates backports across majors, and publishes only Community extracts tied to confirmed CVEs. Diff-only candidates remain internal. Enterprise stays authorization-gated — no proprietary diffs, invented CVEs, or exploit steps.
