Odoo Changelog — 2026-09-23

Wednesday, September 23, 2026

1 change · 19.0

Bug Fixes(1)

Resolved issues and error corrections

[FIX] planning: prevent access error on overlap compute in multi-company

Enterprise19.0planningSecurity

Fixed an issue where Planning could show an access error when scheduling shifts for users working with multiple companies. The overlap check now only considers shifts from companies the user can currently access, preventing crashes and avoiding exposure of restricted company data.

Original PR description

Steps to Reproduce --- 1. Log in as a user with access to multiple companies (e.g., Company A and Company B). 2. Ensure both companies are ticked in the top-right multi-company widget. 3. In the…

Steps to Reproduce
---
1. Log in as a user with access to multiple companies (e.g., Company A and Company B).
2. Ensure both companies are ticked in the top-right multi-company widget.
3. In the Planning app, create a shift for an employee from 09:00 to 17:00 in Company B.
4. Remove the access of Company B
5. In the Planning Gantt view, click the same empty cell to schedule the same employee at the same time for Company A.

Issue
---
The _compute_overlap_slot_count method uses raw SQL to find overlapping shifts. However, this raw SQL fetches overlapping slot IDs from shifts belonging to companies the user has currently deselected or does not have access to.

Current behaviour
---
The raw SQL populates the conflicting_slot_ids field with inaccessible record IDs (the shift from the deselected Company B). This triggers accessError.

Expected behaviour
---
The system should only calculate overlapping shifts for companies the user currently has active in their environment. It should not leak the existence of shifts in deselected/unauthorized companies, and it should open the new shift dialog without crashing.

Fix
---
Add company_id to both raw SQL queries (for existing records and new virtual records) inside _compute_overlap_slot_count. Pass company id to ensure the database only returns conflict IDs that are valid within the user's active multi-company context.

task - 4554813

Forward-Port-Of: odoo/enterprise#109027

#multi-company#access-rights#planning#scheduling

Steps to Reproduce --- 1. Log in as a user with access to multiple companies (e.g., Company A and Company B). 2. Ensure both companies are ticked in the top-right multi-company widget. 3. In the Planning app, create a shift for an employee from 09:00 to 17:00 in Company B. 4. Remove the access of Company B 5. In the Planning Gantt view, click the same empty cell to schedule the same employee at the same time for Company A. Issue --- The _compute_overlap_slot_count method uses raw SQL to find overlapping shifts. However, this raw SQL fetches overlapping slot IDs from shifts belonging to companies the user has currently deselected or does not have access to. Current behaviour --- The raw SQL populates the conflicting_slot_ids field with inaccessible record IDs (the shift from the deselected Company B). This triggers accessError. Expected behaviour --- The system should only calculate overlapping shifts for companies the user currently has active in their environment. It should not leak the existence of shifts in deselected/unauthorized companies, and it should open the new shift dialog without crashing. Fix --- Add company_id to both raw SQL queries (for existing records and new virtual records) inside _compute_overlap_slot_count. Pass company id to ensure the database only returns conflict IDs that are valid within the user's active multi-company context. task - 4554813 Forward-Port-Of: odoo/enterprise#109027