VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jul 3, 2019· Updated Jun 17, 2026

CVE-2018-14866

CVE-2018-14866

Description

Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

10
  • Odcms/Odoo7 versions
    cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*+ 6 more
    • cpe:2.3:a:odoo:odoo:10.0:*:*:*:community:*:*:*
    • cpe:2.3:a:odoo:odoo:10.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:odoo:odoo:11.0:*:*:*:community:*:*:*
    • cpe:2.3:a:odoo:odoo:11.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:odoo:odoo:9.0:*:*:*:community:*:*:*
    • cpe:2.3:a:odoo:odoo:9.0:*:*:*:enterprise:*:*:*
    • (no CPE)range: <=11.0
  • Odoo/Odoo Communitydescription
  • Odcms/Enterprisellm-create
    Range: <=11.0
  • Odcms/Communityllm-create
    Range: <=11.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.