A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows…

published 2020-12-22 5 y ago modified 2026-09-10 59 d ago also BIT-odoo-2020-29396 , EUVD-2020-21769

cvss: 9.9; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.1%; EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.

Patch / fix

fixed in 1 links 2

bitnami odoo 13.0.1

github.com/odoo/odoo/issues/63712 advisory
oracle.com/security-alerts/cpujul2022.html advisory

Exploit prediction

3.13% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	9.9	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
OSV	3.0	9.9	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Affected packages

ecosystem	package	affected	fixed in
bitnami	odoo	>=11.0.0, <13.0.1	13.0.1

Affected products

Odoo Odoo Community
Odoo Odoo Enterprise

Classification

Weakness

CWE-267 Privilege Defined With Unsafe Actions

References

github.com /odoo/odoo/issues/63712
patch, third-party-advisory, advisory
oracle.com /security-alerts/cpujul2022.html
patch, third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2020-29396
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary