Odoo Changelog — 2025-11-15

Saturday, November 15, 2025

1 change · master

Security(1)

Security fixes and vulnerability patches

[FIX] hr_appraisal : fix appraisal goal access right

Enterprisemasterhr_appraisalSECURITY

This fix prevents employees from seeing appraisal goals that are not assigned to them, managed by them, or related to their reporting line. It protects sensitive performance information and ensures appraisal visibility matches the intended access rules.

Original PR description

Step to reproduce:
-------------------

1- Log as Mitchell Admin
2- Create a goal for an employee which is not one of Marc Demo
    subordinnates and don't put him as goal's manager
3- Log As Marc Demo

You will see this goal.
You are not supposed to be able to see this goal.

Forward-Port-Of: odoo/enterprise#97121

#appraisals#access rights#privacy