PT-2026-5726 · Odoo+1 · Odoo+1

E1Mo

·

Published

2026-02-02

·

Updated

2026-02-23

·

CVE-2026-25137

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions Odoo versions 21.11 through 25.10 Odoo versions 26.05
Description The NixOS Odoo package, an open source ERP and CRM system, exposes the database manager without authentication. This allows unauthorized actors to delete and download the entire database, including Odoo’s file store. Unauthorized access can be identified by examining access logs or Odoo’s logs for requests to the /web/database API endpoint. The database manager is intended for development purposes and should not be publicly reachable. Due to the nature of NixOS, Odoo is unable to persist a master password, even when set manually, meaning the password is lost upon restarting Odoo. When no password is set, any user can set one via the database manager without authentication.
Recommendations Odoo versions 21.11 through 25.10: Upgrade to a version after 25.11 and before 26.05. Odoo version 26.05: Upgrade to a newer version.

Exploit

Fix

Missing Authentication

Files Accessible to External Parties

Weakness Enumeration

CWE-306CWE-552

Related Identifiers

CVE-2026-25137
GHSA-CWMQ-6WV5-F3PX

Affected Products

Nixos
Odoo