{"id":"CVE-2019-11783","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-11783","generatedAt":"2026-10-29T01:57:38.461Z","title":"Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to subscribe to arbitrary mail channels uninvited.","description":"Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to subscribe to arbitrary mail channels uninvited.","published":"2020-12-22T17:15:13.000Z","lastModified":"2026-06-17T02:13:38.000Z","status":"Modified","sourceIdentifier":"security@odoo.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-284","CWE-862"],"affected":["odoo/odoo"],"epss":{"score":0.00988,"percentile":0.62303,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.99%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/odoo/odoo/issues/63708","tags":["Third Party Advisory"],"source":"security@odoo.com"},{"url":"https://github.com/odoo/odoo/issues/63708","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-11783","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}