CVE-2021-23203
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports…
Published Apr 25, 2023 · updated Jun 16, 2026 · odoo odoo
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
Timeline
Detection, updates, and resolution for this record.
Apr 25, 2023 · Catalog
Detected
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
Jun 16, 2026 · Catalog
Updated
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
Affected
- cpe odoo/odoo14.0
- cpe odoo/odoo15.0
Sources
- CVE.orgCVE-2021-23203
Official CVE identifier
cve.org - NIST NVDCVE-2021-23203
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.
nvd.nist.gov - Odoo SecurityCVE-2021-23203
Odoo or OpenERP product vulnerability. Vendor discussion stays on the Odoo tracker.
github.com