Odoo Changelog — 2025-10-06

Monday, October 6, 2025

1 change · master

Security(1)

Security fixes and vulnerability patches

[FIX] helpdesk: ensure partner belongs to the same company as the ticket

EnterprisemasterhelpdeskSECURITY

Helpdesk now prevents tickets from being linked to a customer from a different company. This helps ensure users only see and access tickets appropriate to their company, avoiding access errors and reducing data exposure risk.

Original PR description

**Issue**:
It is possible to associate a partner that belongs to a different company than the ticket’s company. As a result, some users could see tickets in the list view that they should not have access to. When attempting to open those tickets, an error was raised. Even worse, in some cases (see the associated ticket), certain users were still able to access them.

**Steps to reproduce**:
- Create two companies (A and B)
- Switch to company A
- Open the Helpdesk application
- Create and open a ticket
- Select both companies A and B
- Assign a partner linked to company B to the ticket
- Save it

opw-4926497

Forward-Port-Of: odoo/enterprise#96193
Forward-Port-Of: odoo/enterprise#93201

#helpdesk#multi-company#access-control