CVE-2024-12368 Missing authorization in Odoo Community

What is CVE-2024-12368?

CVE-2024-12368 is a high-severity missing authorization vulnerability in Odoo Odoo, published on 25 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.

Weakness: CWE-284

Which versions are affected by CVE-2024-12368?

1 open source package ship an affected version, including odoo. It affects 1 product.

Products include Odoo Odoo.

How do I fix CVE-2024-12368?

Upgrade odoo to 15.0.20240510 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-12368 being exploited?

There is no known exploitation of CVE-2024-12368 in the wild and no public exploit code.

Other vulnerabilities in Odoo Odoo

• CVE-2020-29396 Code injection in Odoo Community Critical 9.9
• CVE-2018-14885 Auth bypass in n/a Critical 9.8
• CVE-2017-10804 Auth bypass in n/a Critical 9.8
• CVE-2018-14860 Code injection in n/a Critical 9.1
• CVE-2017-10805 Auth bypass in n/a High 8.8

All Odoo Odoo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-odoo-2024-12368, DEBIAN-CVE-2024-12368, GHSA-j4gm-mr6g-474q, UBUNTU-CVE-2024-12368.