Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests.
cpe:2.3:a:odoo:odoo:*:*:*:*:community:*:*:*
97EB1578-CFCC-4301-AEE7-DBBC6A92BC25
13.0
cpe:2.3:a:odoo:odoo:*:*:*:*:enterprise:*:*:*
3451E55A-C240-40BF-AA17-E11DC5A56002
13.0
OR
# Security Advisory - [CVE-2021-44460](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44460)

**Affects**: Odoo 13.0 and earlier (Community and Enterprise Editions)
**CVE ID**: [CVE-2021-44460](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44460)
**Component**: Core
**Credits**: Xavier Morel

Improper access control in Odoo Community 13.0 and earlier and Odoo
Enterprise 13.0 and earlier allows users with deactivated accounts to
access the system with the deactivated account and any permission it
still holds, via crafted RPC requests.


## I.   Background

Users can be deactivated as a way to keep the past information about them but
no longer allow them to login into an Odoo database. This is the typical
scenario when an employee leaves the company.


## II.  Problem Description

Old users could still interact with the database through the API even though
they were no longer able to login through the login form.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: Deactivated user account required
**CVSS3 Score**: High :: 7.4
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

A old employee or portal might abuse their past privileges to gain access to
recent information.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

Changing the password of deactivated users ensures an old user is no longer
able to craft RPC requests. Updating to the latest revision or applying the
corresponding patch is strongly recommended.

Odoo Cloud servers have been patched as soon as the correction was available.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 13.0: https://github.com/odoo/odoo/commit/8024a6e369b79abb1cbd52840fd66eaec66c07a3
- 13.0-ent (Enterprise): see 13.0.


[SEC] CVE-2021-44460 - Improper access control in Odoo Community 13....
This is a GitHub Issue
repo:odoo
owner:odoo
Title : [SEC] CVE-2021-44460 - Improper access control in Odoo Community 13....
Issue date:

--- start body ---
# Security Advisory - [CVE-2021-44460](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44460)

**Affects**: Odoo 13.0 and earlier (Community and Enterprise Editions)
**CVE ID**: [CVE-2021-44460](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44460)
**Component**: Core
**Credits**: Xavier Morel

Improper access control in Odoo Community 13.0 and earlier and Odoo
Enterprise 13.0 and earlier allows users with deactivated accounts to
access the system with the deactivated account and any permission it
still holds, via crafted RPC requests.


## I.   Background

Users can be deactivated as a way to keep the past information about them but
no longer allow them to login into an Odoo database. This is the typical
scenario when an employee leaves the company.


## II.  Problem Description

Old users could still interact with the database through the API even though
they were no longer able to login through the login form.


## III. Impact

**Attack Vector**: Network exploitable
**Authentication**: Deactivated user account required
**CVSS3 Score**: High :: 7.4
**CVSS3 Vector**: [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

A old employee or portal might abuse their past privileges to gain access to
recent information.

Odoo S.A. is not aware of any use of this vulnerability in the wild.


## IV.  Workaround

Changing the password of deactivated users ensures an old user is no longer
able to craft RPC requests. Updating to the latest revision or applying the
corresponding patch is strongly recommended.

Odoo Cloud servers have been patched as soon as the correction was available.


## V.   Solution

Update to the latest revision, either via GitHub or by downloading it:
  https://www.odoo.com/page/download
If updating is not an option, you may instead apply the patch corresponding
to your Odoo installation (links provided below).

For the actual update procedure, please refer to our update instructions, valid
for all versions: https://www.odoo.com/documentation/15.0/setup/update.html


## VI.  Correction details

The following list contains the patches that fix the vulnerability for
each version:

- 13.0: https://github.com/odoo/odoo/commit/8024a6e369b79abb1cbd52840fd66eaec66c07a3
- 13.0-ent (Enterprise): see 13.0.


--- end body ---

comments :
--- start comments ---

--- end comments ---