CVE-2019-11785

4.3 mediumEPSS 1.5%

Medium (4.3) in odoo odoo. EPSS 1.5% chance of exploitation in the next 30 days.

Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to obtain access to messages posted on business records there were not given access to, and subscribe to receive future messages.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWEs: CWE-862, CWE-284
Published: 2020-12-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

odoo:odoo

References

https://github.com/odoo/odoo/issues/63710
https://github.com/odoo/odoo/issues/63710

Check your stack JSON