CVE-2018-14862
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to d…
Published Jul 3, 2019 · updated Jun 16, 2026 · odoo odoo
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
Timeline
Detection, updates, and resolution for this record.
Jul 3, 2019 · Catalog
Detected
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
Jun 16, 2026 · Catalog
Updated
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
Affected
- cpe odoo/odoo10.0
- cpe odoo/odoo11.0
- cpe odoo/odoo9.0
Sources
- NIST NVDCVE-2018-14862
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
nvd.nist.gov - Odoo SecurityCVE-2018-14862
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com