CVE-2021-23178: 
NixOS vulnerability analysis and mitigation

Improper access control vulnerability (CVE-2021-23178) affects Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier. The vulnerability was discovered by Parth Gajjar and allows attackers to validate online payments with a tokenized payment method belonging to another user (Odoo Issue).

The vulnerability stems from an improper validation in the online payment mechanism that enables recurring payments on ecommerce or subscription services. It has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating network exploitability with no authentication required (NVD).

An attacker can craft a payment request to validate an online purchase, causing the victim's payment method to be charged instead of their own. The vulnerability specifically affects the saved payment method functionality, which is designed to facilitate recurring online payments (Odoo Issue).

The vulnerability has been patched in multiple versions with the following commits: 13.0: 08fe322, 14.0: 5ac5524, and 15.0: 9a06302. Users are strongly recommended to update to the latest revision or apply the corresponding patch. No workaround is available other than updating. Odoo Cloud servers were patched immediately upon correction availability (Odoo Issue, Debian Security).