CVE-2024-12368
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0...
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- Record
CVE-2024-12368- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-53933
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- Record
EUVD-2024-53933- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j4gm-mr6g-474q
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0...
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- Record
GHSA-j4gm-mr6g-474q- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-116, CWE-284
- Updated
- 2026-11-02
NVD
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- Record
CVE-2024-12368- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- Record
CVE-2024-12368- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-12368
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- Record
DEBIAN-CVE-2024-12368- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-12368
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- Record
UBUNTU-CVE-2024-12368- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-odoo-2024-12368 No score
Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.
- Record
BIT-odoo-2024-12368- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
odooBitnami |
15.0.0 up to 15.0.20240510 | 15.0.20240510 |
odooDebian:11 |
All versions, plus listed versions 14.0.0+dfsg.2-714.0.0+dfsg.2-7+deb11u114.0.0+dfsg.2-7+deb11u214.0.0+dfsg.3-114.0.0+dfsg.3-1.1 Show 22 moreShow less14.0.0+dfsg.3-1~bpo11+114.0.0+dfsg.3-1~bpo11+214.0.0+dfsg.3-1~bpo11+314.0.0+dfsg.4-116.0.0+dfsg.1-116.0.0+dfsg.1-1.116.0.0+dfsg.1-216.0.0+dfsg.1-316.0.0+dfsg.2-116.0.0+dfsg.2-1.116.0.0+dfsg.2-1~bpo12+116.0.0+dfsg.2-216.0.0+dfsg.2-2~bpo12+116.0.0+dfsg.2-316.0.0+dfsg.2-3~bpo12+117.0.0+dfsg-117.0.0+dfsg2-117.0.0+dfsg3-118.0.0+dfsg-118.0.0+dfsg-1.118.0.0+dfsg-219.0.0+dfsg-1 |
None known |
odooUbuntu:22.04:LTS |
All versions, plus listed versions 14.0.0+dfsg.2-714.0.0+dfsg.3-1 |
None known |
odooUbuntu:24.04:LTS |
All versions, plus listed versions 16.0.0+dfsg.1-316.0.0+dfsg.2-1.116.0.0+dfsg.2-2 |
None known |
odooUbuntu:25.10 |
All versions, plus listed versions 18.0.0+dfsg-2 |
None known |
odooUbuntu:26.10 |
All versions, plus listed versions 18.0.0+dfsg-2build119.0.0+dfsg-1 |
None known |
odooUbuntu:26.04:LTS |
All versions, plus listed versions 18.0.0+dfsg-218.0.0+dfsg-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-12368 is a high vulnerability (CVSS 8.1) in Odoo, published February 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in odoo 15.0.20240510.