CVE-2018-14868

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-28 · updated 2026-06-17
Weakness: CWE-287

Description

Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.

Affected products

Odoo: 9.0

References

https://github.com/odoo/odoo/commits/master
https://github.com/odoo/odoo/issues/32507
https://github.com/odoo/odoo/commits/master
https://github.com/odoo/odoo/issues/32507

Get alerted when CVE-2018-14868 or the next vulnerability affects your stack