CVE-2019-11785
Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain…
Published Dec 22, 2020 · updated Jun 16, 2026 · odoo odoo
Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages.
Timeline
Detection, updates, and resolution for this record.
Dec 22, 2020 · Catalog
Detected
Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages.
Jun 16, 2026 · Catalog
Updated
Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages.
Affected
- cpe odoo/odooversion unspecified
Sources
- CVE.orgCVE-2019-11785
Official CVE identifier
cve.org - NIST NVDCVE-2019-11785
Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future me
nvd.nist.gov - Odoo SecurityCVE-2019-11785
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com