Daily updates from Odoo
Monday, March 23, 2026
1 change · 18.0
Resolved issues and error corrections
This update addresses a security vulnerability where automated email scanners could unintentionally cancel appointments through a simple link. By changing the appointment cancellation link to a POST form, we now require a deliberate user action to cancel, mitigating this risk and improving security.
Original PR description
Mail link scanners often follow GET links in emails to check for malicious content. If the appointment cancelation link is a simple GET link, these scanners can inadvertently cancel the appointment. This commit converts the link into a POST form to ensure that cancellation requires a deliberate user action and is not triggered by automated scanners. opw-5722533