CVE-2024-12368: odoo · Improper Access Control
Affects odooSource GCVE Database
Not known to be exploited : upgrade to 15.0.20240510 soon.
Data as of 26 Oct 2026, 12:54 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 52% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 15.0.20240510
Exploitation evidence
Disclosed: evidence found.
CVE published 2 Mar 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade odoo to 15.0.20240510.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Bitnamiodoopkg:bitnami/odooOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available for this vulnerability. Users should upgrade to version 15.0.20240510 or later to remediate the issue. Applying the official fix will prevent internal users from exporting OAuth tokens of other users.
Description
An improper access control vulnerability exists in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0. This flaw allows an internal user to export OAuth tokens belonging to other users. The vulnerability affects versions from 15.0.0 up to but not including 15.0.20240510. A patch is available to address this issue. No known exploits are reported in the wild.