CVE-2021-45111

What it actually does

Improper access control permits remote authenticated users to invoke demonstration data creation routines that instantiate new user accounts preconfigured with static known credentials.

Why it matters to the business

Attackers can obtain additional accounts with predictable passwords, enabling lateral movement, data access, or privilege escalation inside the ERP instance without further authentication.

How an attack unfolds

An attacker authenticates with any valid low-privilege account, locates the demonstration data creation endpoint, triggers the routine, and receives newly created accounts whose credentials are publicly documented or easily guessed.

How to fix it

Upgrade Odoo Community and Enterprise to versions later than 15.0 that contain the corrected access control checks; alternatively, disable demonstration data creation in production configurations and remove any demo users created by the flaw.

How to confirm the fix worked

Review the source of the demonstration data creation controller to confirm authentication and authorization decorators are present; attempt to trigger demo data creation with a non-admin authenticated session and verify the action is rejected.

Typical attack path

1. Obtain valid low-privilege credentials via prior compromise or social engineering
2. Authenticate to the Odoo web interface
3. Issue a request to the demonstration data creation controller
4. Receive newly provisioned accounts and their static credentials
5. Authenticate with the new accounts to expand access

How to detect it

Inspect web access logs for POST requests to demonstration data creation endpoints originating from non-admin sessions; search application logs for creation of users with names matching demo patterns and immediate subsequent authentication events.

What your security team should do

• Prioritize upgrade of all Odoo 15.0 and earlier instances to a patched release
• Audit existing user accounts for any unexpected demo-created entries
• Disable demo data functionality in production environments via configuration
• Monitor authentication logs for logins using known demo credentials