CVE-2026-108861

Odoo MCP versions 1.0.0 through 1.3.2 are vulnerable to an information disclosure flaw within the execute_method tool . This vulnerability allows MCP clients or prompt-injected agents to bypass field-level Access Control Lists (ACL) . By invoking the execute_method tool and naming fields that sho...

CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...