CVE-2026-108861

Odoo MCP versions 1.0.0 through 1.3.2 are vulnerable to an information disclosure flaw within the execute_method tool . This vulnerability allows MCP clients or prompt-injected agents to bypass field-level Access Control Lists (ACL) . By invoking the execute_method tool and naming fields that sho...