Thursday, February 5, 2026
1 change · saas-19.1
Resolved issues and error corrections
This update fixes a security vulnerability where scheduled actions could continue running even with archived or unauthorized users. Previously, any user could trigger a server action, regardless of their access rights. Now, actions will only run with valid, active users (excluding system accounts), improving security and preventing unintended actions.
Original PR description
Any user can be used to run a server action, even if archived or without corresponding access right. Steps: - Create a scheduled action running with an administrator (code: empty) - Archive the used administrator - Do the same steps with random user Actual result: - Action continue to run with an archived user - Action continue to run with a user without corresponding access right Expected result: - Action should not run on a archived user (except System) - Action can run if user has corresponding access right opw-5475805 Forward-Port-Of: odoo/odoo#244416