Daily updates from Odoo
Sunday, March 29, 2026
2 changes · 17.0
Resolved issues and error corrections
This update resolves a security vulnerability where users with limited access could inadvertently read data from related records when using computed x2many fields with sudo access. The fix ensures that read access is properly managed, preventing unauthorized data retrieval and maintaining data security. This primarily impacts company-level data access.
Original PR description
Given a x2many field computed with `compute_sudo=True`, it is possible that the value computed value returns records that the user cannot read, which is fine because the user can only see the id of…
Given a x2many field computed with `compute_sudo=True`, it is possible that the value computed value returns records that the user cannot read, which is fine because the user can only see the id of the record an it's name, but nothing more. However, trying to read that field with the field's getter will call `convert_to_record`, which will filter the active records or not depending on the context key `active_test`, because the cache is shared between the different contexts. This is done performing a `filtered` on the records, which requires read access on the returned records. To reproduce: * Create a company branch * Create a new user with access only to that company branch * Try to read `parent_ids` of that new branch. It is particularly important to have access at least to the ids of the companies because one can have access to records belonging to the parent company without having access to the company itself (i.e. accounting accounts, journals, taxes, analytic accounts, products, ...)
Following the Odoo 17 upgrade, users experienced an inability to view products. This pull request addresses this issue by correcting a query error that was causing the problem. The fix ensures that product viewing functionality is restored, improving usability for all users.
Original PR description
Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr