CVE-2021-44465

What it actually does

The flaw allows authenticated users to bypass record-level access controls and subscribe to notifications and comments on arbitrary business records through crafted RPC requests.

Why it matters to the business

Attackers can obtain ongoing visibility into sensitive business records and communications without authorization, increasing the risk of information leakage and compliance violations.

How an attack unfolds

An attacker with valid credentials identifies target record identifiers and sends specially crafted RPC requests to subscribe to their notification streams, receiving future comments and updates on records they should not access.

How to fix it

Upgrade Odoo to a patched release that enforces proper authorization checks on subscription RPC calls. Restrict RPC access where possible and apply the latest security updates as they become available.

How to confirm the fix worked

Test subscription functionality from accounts with limited permissions to confirm that subscriptions are rejected for records outside the user's authorized scope. Review audit logs for subscription attempts.

Typical attack path

1. Obtain valid low-privilege user credentials
2. Enumerate or guess target record identifiers
3. Issue crafted RPC subscription requests for those records
4. Receive and review incoming notifications for sensitive data

How to detect it

Inspect RPC request logs for subscription operations targeting record IDs where the requesting user lacks corresponding read permissions. Correlate with user activity to identify accounts subscribing to unrelated records.

What your security team should do

• Apply available Odoo security updates immediately
• Audit RPC access patterns for anomalous subscription activity
• Enforce least-privilege principles on record access
• Monitor for accounts subscribing to unusually large numbers of records