Odoo · versions
Odoo 16 security vulnerabilities
Odoo 16 ships as Odoo Community (open source) and Odoo Enterprise (proprietary). Public patch evidence on this site covers Community Git only.
Evidence status
0 version-attributed CVE rows in this catalog for Odoo 16. That means incomplete or pending attribution for these version tokens — not that the release is free of vulnerabilities. Zero matches is never proof Odoo 16 is secure. Coverage can lag vendor disclosure. Always verify the original advisory.
Version overview
- Odoo 16 is a major Odoo series used by ERP administrators and hosting providers.
- Security posture depends on the exact Community (and optional Enterprise) revision you run — not only the major version number.
- Vendor advisories, backport policy, and installed modules all change exposure. A quiet CVE list is not a clean bill of health.
Security advisories for Odoo 16
Confirmed catalog rows attributed to this version series via affected ranges, advisory text, or CVE-linked fix commits on 16.0.
No version-attributed CVE rows yet. That is an evidence gap in this catalog, not a security certification. Review the broader Odoo list below and run the revision / version checker.
Patch information
Public, disclosed Community fix commits attributed to 16.0. Proprietary Enterprise diffs are never shown.
No public disclosed fix commits for 16.0 are listed yet. Use the revision checker when you have a concrete SHA or package version.
Disclosed public references on file for 16.0: 0.
Security changes & hardening
Follow the Odoo security updates timeline for confirmed fixes, dependency remediations, and hardening events. Ordinary bugfixes are excluded from that timeline.
How to identify your installed revision
- From the Odoo shell: open the database manager or Settings → About to read the build / commit when exposed by your packaging.
- On source installs, run `git -C /path/to/odoo rev-parse HEAD` on the Community repository (and Enterprise if authorized).
- Container or Debian packages: map the package version to the upstream commit your vendor documents — do not assume the tag equals a security backport.
- Record both the major series (e.g. 18.0) and the full SHA before asking whether a disclosed fix is present.
Security checker
Paste your Community SHA to see whether disclosed fixes for 16.0 are already ancestors of your revision.
Monitoring
Watch the Odoo stack for newly ingested advisories. Alerts follow your account package — they do not invent exploitability for Odoo 16.
Broader Odoo catalog
56 recordsNo advisory in this catalog names Odoo 16 yet. These are Odoo core records that do name a series, so the gap is visible instead of filled with unrelated products.
- Medium6.5Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an or…Check if you run itEPSS 0.69%Feb 25, 2025
- High8.8Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.Check if you run itEPSS 0.69%Feb 25, 2025
- High8.1Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstrat…Check if you run itEPSS 0.84%Apr 25, 2023
- Medium6.1Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the br…Check if you run itEPSS 0.65%Apr 25, 2023
- Medium6.1Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary we…Check if you run itEPSS 0.55%Apr 25, 2023
- Critical9.1A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.Check if you run itEPSS 0.69%Apr 25, 2023
- Medium6.8A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, inclu…Check if you run itEPSS 0.48%Apr 25, 2023
- Medium4.3Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notificat…Check if you run itEPSS 0.46%Apr 25, 2023
- Medium6.1Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting jou…Check if you run itEPSS 0.49%Apr 25, 2023
- Medium6.5Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the de…Check if you run itEPSS 0.69%Apr 25, 2023