VULNERABILITY INTELLIGENCE

CVE-2021-44460

CVSS score6.5 MEDIUM

EPSS probability0.69%

CISA KEVNot currently listed

Published2023-04-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests.

Weakness classification

CWE-284: Improper Access Control

Primary references

security@odoo.com — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory