CVE-2018-15645: 
NixOS vulnerability analysis and mitigation

Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation. The vulnerability was discovered by Nils Hamerlinck from Trobz and affects both Community and Enterprise editions of Odoo up to version 12.0 (Odoo Issue).

The vulnerability exists in the Discuss module, which handles discussions between users and provides discussion threads on business objects. Messages can be sent via the user interface or over email. A programming error in the email processing mechanism allowed unauthorized users to abuse the system. The vulnerability has been assigned a CVSS v3.0 base score of 8.1 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network exploitability with low attack complexity requiring user authentication (Odoo Issue).

An attacker with a Portal user account could craft special requests to create arbitrary records with chosen attributes, potentially leading to privilege escalation. The vulnerability affects data confidentiality and integrity, though system availability remains unaffected (Odoo Issue).

The vulnerability requires network access and user authentication to exploit. Odoo S.A. reported no known instances of this vulnerability being exploited in the wild at the time of disclosure (Odoo Issue).

No workarounds were available for this vulnerability. The recommended solution was to apply security patches or upgrade to the latest version. The vulnerability was fixed in revisions fd77cc7 (11.0) and 5b6e811 (12.0) for both Community and Enterprise editions. Odoo Cloud servers were patched immediately upon correction availability (Odoo Issue).