Daily updates from Odoo
Wednesday, March 25, 2026
1 change
Resolved issues and error corrections
This update fixes a vulnerability where email bots could automatically cancel meetings by visiting links in invitation emails. We’ve changed how meeting invitations are sent to include buttons instead of direct links, preventing bots from triggering unwanted actions. This improves security and ensures meetings are only cancelled by users.
Original PR description
Mails are sent to users containing an acceptation and cancellation link that accepts GET requests but performs an action on visit Some mail defender software analyzes urls in links by actually visiting the URL. This leads to both actions being triggered without user input. Instead we now send buttons with a neutralizing parameter in the mail. Recipients may then visit the url and click a form button to "accept" or "decline". As these are post requests, the email bots should avoid clicking them. task-4555579 Forward-Port-Of: odoo/odoo#254692 Forward-Port-Of: odoo/odoo#198560