Odoo security vulnerabilities
Current Odoo CVEs, version-specific exposure, verified Community security-fix commits, patch timelines, monitoring, and a free revision checker.
Built for ERP administrators and hosting providers.
56 public records · 5 security-fix timeline events.
Version-specific security
High-intent pages for “Odoo {version} security vulnerabilities” queries.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Check whether a precise Community revision already contains disclosed fixes.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-07-210 issues2026-10-18
Known exploited
View all known exploitedRecently published
Browse catalog- Medium4.3The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.20%May 15, 2026
- High8.8Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.Check if you run itEPSS 0.69%Feb 25, 2025
- Critical9.1A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.Check if you run itEPSS 0.69%Apr 25, 2023
- High8.7A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.Check if you run itEPSS 0.65%Apr 25, 2023
- High8.1Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.Check if you run itEPSS 0.96%Jul 3, 2019
- Medium5.4Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection.Check if you run itEPSS 2.66%May 22, 2019
- High8.8Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.Check if you run itEPSS 7.78%Apr 9, 2019
- Medium6.5Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service.Check if you run itEPSS 5.65%Jun 4, 2017