CVE-2021-44460

What it actually does

The flaw permits deactivated user accounts to bypass account status checks and execute RPC requests using their retained permissions, allowing unauthorized system access.

Why it matters to the business

Former or suspended users can continue accessing sensitive business data and performing actions, increasing risk of data leaks or unauthorized operations even after account deactivation.

How an attack unfolds

An attacker uses a known deactivated account to send specially crafted RPC requests that evade deactivation enforcement, retaining access to permitted resources.

How to fix it

Upgrade Odoo Community and Enterprise to versions later than 13.0 that enforce proper deactivation checks on RPC requests; implement additional server-side validation for account status on all access paths.

How to confirm the fix worked

Attempt RPC access using deactivated test accounts and confirm that requests are rejected; review audit logs for any post-deactivation activity.

Typical attack path

1. Obtain credentials or session for a deactivated account
2. Craft RPC requests targeting specific endpoints
3. Bypass account status validation via malformed requests
4. Perform actions or retrieve data using retained permissions

How to detect it

Search application and RPC logs for requests associated with user accounts marked as inactive or archived; correlate with timestamps after deactivation dates.

What your security team should do

• Audit all deactivated accounts and revoke associated permissions immediately
• Monitor RPC traffic for patterns originating from inactive users
• Apply available patches or configuration updates to enforce account deactivation
• Test deactivation enforcement in staging environments before production rollout