CVE-2018-14864: Odoo

Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated users to inject arbitrary web script via a crafted attachment.

Affected products

• Odoo Odoo: version 8.0 only; version 9.0 only; version 10.0 only

Published 2019-07-03. Last modified 2026-06-17.