Odoo Changelog — 2026-07-08

Wednesday, July 8, 2026

3 changes

Branch: saas-19.4

2 changes

Security(1)

Security fixes and vulnerability patches

[FIX] sign: harden "Auto write" feature against edge cases

PR #123258

Enterprisesaas-19.4signSECURITY

This update adds safeguards to prevent Sign's auto-write option from being enabled in situations where it could update records unintentionally or expose invalid fields. It also improves related checks and messaging so users get clearer feedback and sensitive information is better protected.

Original PR description

Fix scenarios where the auto-write feature could fail or be unsafe:

- Prevent unsafe mass updates: Users could enable auto-write in bulk without proper awareness, leading to unintended behavior. Additionally, the field could be manually exposed even when no linked model/field is set. we add safeguards and constraints to prevent enabling it in invalid cases.

- Improve test coverage: Update test cases to ensure correct behavior when users have access to partner records but must not be allowed to update sensitive fields (e.g., email) of other users through those records.

task-6147410

Forward-Port-Of: odoo/enterprise#115118

#sign#auto-write#data-protection#permissions

Bug Fixes(1)

Resolved issues and error corrections

[FIX] mail_tracking: fix check on 'tracking_value_ids'

PR #275056

Coresaas-19.4mail_trackingSECURITY

This update addresses a security vulnerability where standard users could access restricted data within the mail tracking system. The fix prevents unauthorized access to 'tracking_value_ids', ensuring data privacy and security. This resolves a previously identified issue impacting the integrity of mail tracking functionality.

Original PR description

Field is not accessible to standard users.

Task-6368820
Part of Task-3704380

Forward-Port-Of: odoo/odoo#274989

#security#mail#tracking

Branch: 19.0

1 change

Security(1)

Security fixes and vulnerability patches

[FIX] l10n_{ch,id,tr}_hr_payroll: add payroll group on payroll fields

PR #122293

Enterprise19.0l10n_ch_hr_payrolll10n_id_hr_payrolll10n_tr_hr_payrolll10n_us_hr_payroll_adpSECURITY

Employee payroll information in the Swiss, Indonesian, Turkish, and US ADP payroll modules is now limited to authorized payroll users. This helps prevent non-payroll staff from viewing sensitive payroll-related fields in employee records.

Original PR description

This commit adds `groups="hr_payroll.group_hr_payroll_user"` to all fields displayed inside payroll tab in the form view of employee to make sure those fields are only accessible to payroll users.

runbot-error-234071

#payroll#employee-data#access-control

Fix scenarios where the auto-write feature could fail or be unsafe: - Prevent unsafe mass updates: Users could enable auto-write in bulk without proper awareness, leading to unintended behavior. Additionally, the field could be manually exposed even when no linked model/field is set. we add safeguards and constraints to prevent enabling it in invalid cases. - Improve test coverage: Update test cases to ensure correct behavior when users have access to partner records but must not be allowed to update sensitive fields (e.g., email) of other users through those records. task-6147410 Forward-Port-Of: odoo/enterprise#115118

This commit adds `groups="hr_payroll.group_hr_payroll_user"` to all fields displayed inside payroll tab in the form view of employee to make sure those fields are only accessible to payroll users. runbot-error-234071