CVE-2018-14867
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on beh…
Published Jun 28, 2019 · updated Jun 16, 2026 · odoo odoo
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Timeline
Detection, updates, and resolution for this record.
Jun 28, 2019 · Catalog
Detected
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Jun 16, 2026 · Catalog
Updated
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
Affected
- cpe odoo/odoo10.0
- cpe odoo/odoo9.0
Sources
- NIST NVDCVE-2018-14867
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
nvd.nist.gov - Odoo SecurityCVE-2018-14867
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com