Wednesday, May 27, 2026
1 change · 19.0
Security fixes and vulnerability patches
Deleting attachments from the Chatter now follows the configured deletion permissions. This prevents users without delete rights from removing files they should not be able to delete, improving data protection and consistency.
Original PR description
## Problem
The mail_attachment_delete controller only checked attachment ownership via _has_attachments_ownership before deleting with sudo(), bypassing perm_unlink configured in ir.model.access entirely.
## Before this fix
Users with perm_unlink = False on ir.attachment could still delete attachments via the Chatter. The sudo() call bypassed ACL completely with no error shown to the user.
## After this fix
has_access("unlink") is checked before deletion, consistent with how mail_attachment_pdf_first_page checks has_access("read"). ACL is now uniformly enforced for both read and delete operations.
Fixes #265431