CVE-2019-11785: 
NixOS vulnerability analysis and mitigation

Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, identified as CVE-2019-11785, allows remote authenticated users to gain unauthorized access to messages and subscribe to future messages on business records they should not have access to. The vulnerability was disclosed on December 22, 2020, affecting both Community and Enterprise editions of Odoo up to version 13.0 (GitHub Issue).

The vulnerability exists in the Discuss application's mail module, which provides generic productivity components to other Odoo Apps, including a system for private or public discussion channels. The security flaw stems from missing access control mechanisms that should prevent unauthorized users from becoming followers of arbitrary database records. The vulnerability has been assigned a CVSS3 Score of 6.5 (Medium) with a vector of CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network exploitability requiring user authentication (GitHub Issue).

The vulnerability allows malicious external users with Portal access to read past private discussions on documents and receive future notifications on these documents by becoming unauthorized followers of arbitrary database records. This could lead to significant information disclosure of sensitive business communications (GitHub Issue).

The vulnerability requires network access and user authentication to exploit. The attack can be executed through specially crafted requests to become a follower of arbitrary database records. Odoo S.A. reported no known exploitation of this vulnerability in the wild (GitHub Issue).

No workarounds were available for this vulnerability. The recommended solution was to apply security patches or upgrade to the latest revision. The vulnerability was fixed in the following versions: 11.0 (revision a11cb62), 12.0 (revision 4435170), and 13.0 (revision 1e00521). Odoo Cloud servers were patched immediately upon correction availability (GitHub Issue).