Odoo Changelog — 2026-07-07

Tuesday, July 7, 2026

1 change · master

Security(1)

Security fixes and vulnerability patches

[IMP] hr_appraisal: validate read/write access

Enterprisemasterhr_appraisalhr_appraisal_skillsSECURITY

Appraisal permissions are now enforced in the underlying business logic, not only in the web interface. This helps prevent employees from using APIs to change restricted appraisal information or perform manager-only actions.

Original PR description

A lot of the access restrictions within the appraisal app, such as field visibility, editability and certain actions, were enforce only at the view layer through invisible/read-only. This works great for the usual case when uses the web-ui. However, when using the JSON2 API to interact with the appraisal app, the user could bypass these "security rules" as the usual invisible/read-only restrictions don't apply to the API. So a normal user could for example, modify the private note or mark an appraisal as done through the API which was impossible for them to do through the web-ui.

This PR introduces the same security rules and validations to the model layer itself which makes it harder to perform unauthorized actions regardless of the interfaces.

Task-5926306

#appraisals#access control#API security