Daily updates from Odoo
Monday, June 29, 2026
1 change · master
Resolved issues and error corrections
This change makes sure only users with the proper accounting permissions can access detailed move line data in reports. It closes a gap where some users could reach the model but still rely on filtering rules that were no longer enough, improving protection of sensitive accounting information.
Original PR description
Using check_access on the model alone is not enough, as some groups (like portal) could have access to the model itself but rely on record rules (which we now bypass) for filtering access to actual records. This check is there for extra-safety (the access rules to account.report should anyway prevent access) ; we fix it by explicitly checking the user has the proper accounting groups. Forward-Port-Of: odoo/enterprise#120749