Daily updates from Odoo
Wednesday, June 17, 2026
1 change
Resolved issues and error corrections
This update strengthens security around financial reports by ensuring users have the correct accounting group permissions. Previously, access checks were insufficient, allowing certain groups (like the portal) to view reports. This fix adds a more robust check for accounting group membership to prevent unauthorized access.
Original PR description
Using check_access on the model alone is not enough, as some groups (like portal) could have access to the model itself but rely on record rules (which we now bypass) for filtering access to actual records. This check is there for extra-safety (the access rules to account.report should anyway prevent access) ; we fix it by explicitly checking the user has the proper accounting groups.