Daily updates from Odoo
Wednesday, April 1, 2026
1 change · master
Resolved issues and error corrections
This update fixes a security issue where cached relationship data (like linked tags or contacts) could show records a user shouldn't have access to. Previously, if an administrator accessed a record's relationships first, regular users would see the same unrestricted data from cache. Now the system properly filters cached data based on each user's actual permissions, ensuring users only see records they're authorized to view.
Original PR description
The values in cache are put in sudo and filtered when converting to records. This way, no matter who reads the field first, the cache contains all ids of corecords which we can filter as we convert from cache to recordset. In other words, `record.tag_ids` returns accessible tags to the current user linked to the record. However, if we had code `record.sudo().tag_ids` that returned all records, `record.tag_ids` would return the same records afterwards directly from cache. Now we filter only accessible corecords before returning them.