Odoo · versions
Odoo 18 security vulnerabilities
Odoo 18 ships as Odoo Community (open source) and Odoo Enterprise (proprietary). Public patch evidence on this site covers Community Git only.
Evidence status
1 version-linked advisories are attributed in this catalog (1 via branch-linked fix commits). Zero matches is never proof Odoo 18 is secure. 29 Community commits on 18.0 are flagged as security candidates in private analysis; only disclosed public fixes appear below. Coverage can lag vendor disclosure. Always verify the original advisory.
Version overview
- Odoo 18 is a major Odoo series used by ERP administrators and hosting providers.
- Security posture depends on the exact Community (and optional Enterprise) revision you run — not only the major version number.
- Vendor advisories, backport policy, and installed modules all change exposure. A quiet CVE list is not a clean bill of health.
Security advisories for Odoo 18
Confirmed catalog rows attributed to this version series via affected ranges, advisory text, or CVE-linked fix commits on 18.0.
Patch information
Public, disclosed Community fix commits attributed to 18.0. Proprietary Enterprise diffs are never shown.
Jun 5, 2024
[REF] web_tour: prepare to change the default action in tour_compiler
CVE-2019-11786 · 4cc6ca11801c · GitHub
Disclosed public references on file for 18.0: 1.
Security changes & hardening
Follow the Odoo security updates timeline for confirmed fixes, dependency remediations, and hardening events. Ordinary bugfixes are excluded from that timeline.
How to identify your installed revision
- From the Odoo shell: open the database manager or Settings → About to read the build / commit when exposed by your packaging.
- On source installs, run `git -C /path/to/odoo rev-parse HEAD` on the Community repository (and Enterprise if authorized).
- Container or Debian packages: map the package version to the upstream commit your vendor documents — do not assume the tag equals a security backport.
- Record both the major series (e.g. 18.0) and the full SHA before asking whether a disclosed fix is present.
Security checker
Paste your Community SHA to see whether disclosed fixes for 18.0 are already ancestors of your revision.
Monitoring
Watch the Odoo stack for newly ingested advisories. Alerts follow your account package — they do not invent exploitability for Odoo 18.
Broader Odoo catalog
56 recordsOther recent Odoo findings that are not tied to Odoo 18. Use each CVE’s version checker before you treat one as in range.
- Medium6.5Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an or…Check if you run itEPSS 0.69%Feb 25, 2025
- High8.8Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.Check if you run itEPSS 0.69%Feb 25, 2025
- High8.1Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstrat…Check if you run itEPSS 0.84%Apr 25, 2023
- Medium6.1Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the br…Check if you run itEPSS 0.65%Apr 25, 2023
- Medium6.1Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary we…Check if you run itEPSS 0.55%Apr 25, 2023
- Critical9.1A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.Check if you run itEPSS 0.69%Apr 25, 2023
- Medium6.8A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, inclu…Check if you run itEPSS 0.48%Apr 25, 2023
- Medium4.3Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notificat…Check if you run itEPSS 0.46%Apr 25, 2023
- Medium6.1Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting jou…Check if you run itEPSS 0.49%Apr 25, 2023
- Medium6.5Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the de…Check if you run itEPSS 0.69%Apr 25, 2023