VULNERABILITY INTELLIGENCE

CVE-2019-11784

CVSS score6.5 MEDIUM
EPSS probability0.99%
CISA KEVNot currently listed
Published2020-12-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to.

Weakness classification

  • CWE-284: Improper Access Control
  • CWE-862: Missing Authorization

Primary references