VULNERABILITY INTELLIGENCE

CVE-2019-11785

CVSS score4.3 MEDIUM
EPSS probability1.49%
CISA KEVNot currently listed
Published2020-12-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages.

Weakness classification

  • security@odoo.com: CWE-284
  • nvd@nist.gov: CWE-862

Primary references