CVE-2021-23186 Missing authorization in Odoo Community
Authenticated administrators can access and modify other tenants' database contents in multi-tenant Odoo deployments due to sandboxing flaws.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23186?
CVE-2021-23186 is a high-severity missing authorization vulnerability in Odoo Odoo, published on 25 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents of other tenants, in a multi-tenant system.
Weakness: CWE-267
Which versions are affected by CVE-2021-23186?
1 open source package ship an affected version, including odoo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
odoo Bitnami | All versions | 15.0.1 |
Products include Odoo Odoo.
How do I fix CVE-2021-23186?
Upgrade odoo to 15.0.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-23186 being exploited?
There is no known exploitation of CVE-2021-23186 in the wild and no public exploit code.
Other vulnerabilities in Odoo Odoo
Sources
Also known as BIT-odoo-2021-23186, DEBIAN-CVE-2021-23186, GHSA-3q52-hrc2-cq56, UBUNTU-CVE-2021-23186.