Community 12.0+ (auto-extends to new majors such as 20.0). Only confirmed, CVE-linked Community disclosures are shown here. Diff-based security-fix candidates and Enterprise analysis stay internal for research — never published as vulnerabilities on their own.
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitr…
Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.
Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an…
Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials.
[IMP] payment stripe: migrate to a direct payment flow The Reserve Bank of India (RBI) issued a directive (amended subsequently in December 2020 and March 2021) that i…
[IMP] payment stripe: migrate to a direct payment flow The Reserve Bank of India (RBI) issued a directive (amended subsequently in December 2020 and March 2021) that introduces additional security measures for recurring payments on India-issued cards. These…
[IMP] payment stripe: migrate to a direct payment flow · modules: payment, payment_stripe, sale · Access control
[IMP] payment stripe: migrate to a direct payment flow
The Reserve Bank of India (RBI) issued a directive (amended subsequently
in December 2020 and March 2021) that introduces additional security
measures for recurring payments on India-issued cards. These measures
include:
- Banks must register cardholders and create an e-mandate through a
one-time process, using additional factor authentication (AFA)
like 3D Secure (3DS).
- Banks must alert cardholders at least 24 hours before charges take
place and give them the ability to opt out of transactions.
- Recurring transactions over 15,000 INR (or equivalent in other
currencies) must go through AFA each time.
Stripe has worked with a partner platform to support that, but we must
manipulate the PaymentIntent and SetupIntent objects directly through
their dedicated API, which the Checkout API does not allow. Therefore,
we must now…
The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service) under c…
The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service) under certain circumstances.
Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to esca…
Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system.
Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset th…
Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.
Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkh…
Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkhtmltopdf, which allows remote attackers to read local files.
Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated u…
Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment.
Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.
Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to d…
Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request.
No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.
Confirmed Community Git disclosures
Quoted commit messages that cite a catalog CVE. Cross-branch equivalents (17.0 / 18.0 / 19.0+) are grouped by Change-Id, CVE, and changed symbols when known. Unpublished fix candidates are not listed.
5 Community Git rows.
Feb 16, 2026 · Potential XSS correction · Confirmed reference
[IMP] web: StaticList: support SET (6) orm command
Modules: web
[IMP] web: StaticList: support SET (6) orm command
Before this commit, `_applyCommands` didn't support SET command
(command 6). As a consequence, this command had to be special-cased
in `_preprocessX2manyChanges`, and in an override of `Record` in
the ai_fields addon [1].
With this commit, the SET command is now supported in
`_applyCommands`, and a `set()` function has been added on
StaticList for convenience.
Note: since [2], onchange no longer returns SET commands (it only
returns commands from 0 to 4). So this commit adapts a historical
test that still simulated an onchange returning a SET command as
first command.
No task, but followup of [3]
[1] https://github.com/odoo-dev/enterprise/blob/366f0376644d4aecd239378782d2db896ea7bf9f/ai_fields/static/src/model/relational_model/record.js#L26
[2] https://github.com/odoo/odoo/pull/119510
[3] https://github.com/odoo/enterprise/pull/830…
[IMP] web: StaticList: support CLEAR (5) orm command
Modules: web
[IMP] web: StaticList: support CLEAR (5) orm command
Before this commit, the StaticList didn't expose a way to apply
a CLEAR command (command 5), i.e. to empty the relation. This
commit adds a `clear()` function to do so, and adds the support of
the CLEAR command in `_applyCommands`.
Note: since [1], onchange no longer returns CLEAR commands (it only
returns commands from 0 to 4). So this commit adapts a few historical
tests that still simulated onchanges returning a CLEAR command as
first command.
Request for task~5350021
[1] https://github.com/odoo/odoo/pull/119510
Part-of: odoo/odoo#249054
Related: odoo/enterprise#107694
[REF] web_tour: prepare to change the default action in tour_compiler
Currently, in tour_compiler, to check that an element is actually
present in the DOM in a step, there are 2 possibilities.
- `isCheck: true` => Checks that the element is in the DOM.
The latter can be disabled.
- `run() {}` => Checks that the element is in the DOM (because this
is what is done by default). However, if the element is disabled,
the step will be aborted.
In the codebase, we can see a lot of `run() {} //it's a check` and
`isCheck:true`. However, the behavior is not exactly the same.
What's more, there are 2 ways to do "the same thing".
In order to clarify the turns API, it was decided to no longer put an
action (step.run) by default. (Previously, the default action was
the "click" action).
From then on, it is no longer necessary to stipulate
`step.isCheck: true` nor `run() {}`.
The corollary is that now…
[IMP] payment stripe: migrate to a direct payment flow
Modules: payment, payment_stripe, sale
[IMP] payment stripe: migrate to a direct payment flow
The Reserve Bank of India (RBI) issued a directive (amended subsequently
in December 2020 and March 2021) that introduces additional security
measures for recurring payments on India-issued cards. These measures
include:
- Banks must register cardholders and create an e-mandate through a
one-time process, using additional factor authentication (AFA)
like 3D Secure (3DS).
- Banks must alert cardholders at least 24 hours before charges take
place and give them the ability to opt out of transactions.
- Recurring transactions over 15,000 INR (or equivalent in other
currencies) must go through AFA each time.
Stripe has worked with a partner platform to support that, but we must
manipulate the PaymentIntent and SetupIntent objects directly through
their dedicated API, which the Checkout API does not allow. Therefore,
we must now…
[FIX] reqs: bump up recommended `requests` version
[FIX] reqs: bump up recommended `requests` version
In light of CVE-2018-18074, using python-requests 2.20.0 is recommended,
or any distribution-specific version that was patched.
See also https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074
Hourly ingest discovers new Community/Enterprise N.0 branches, classifies commits from messages and code diffs (access rights, record rules, controllers, sudo(), SQL construction, HTML escaping), correlates backports across majors, and publishes only Community extracts tied to confirmed CVEs. Diff-only candidates remain internal. Enterprise stays authorization-gated — no proprietary diffs, invented CVEs, or exploit steps.
