Description

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-11T14:17:06.077Z",
  "pubdate": "2026-10-11T14:17:06.077Z",
  "executiveSummary": "Odoo MCP versions 1.0.0 through 1.3.2 are susceptible to an information disclosure vulnerability stemming from insufficient access control enforcement within the execute_method tool.\nThe vulnerability allows authenticated MCP clients or compromised agents to circumvent field-level access control lists (ACLs) by programmatically invoking sensitive methods.\nBy leveraging the execute_method tool, an attacker can execute read or search_read operations on restricted fields that should otherwise be redacted based on the user's defined permissions.\nThis vulnerability exposes sensitive business logic and data, potentially leading to unauthorized disclosure of proprietary information.\nSuccessful exploitation requires the ability to interact with the Odoo MCP interface, which could be initiated via direct access or indirect prompt injection in an AI-integrated environment.\nThe risk is significant as it undermines the integrity of the Odoo security model regarding data visibility.",
  "technicalDetails": "The core issue resides in the insufficient validation of user-requested method execution within the Odoo MCP interface. The execute_method tool acts as a bridge, allowing clients to invoke arbitrary methods on models without adequate security context validation for the specific field-level permissions.\nWhen a request is processed via execute_method, the system fails to verify whether the invoking client has the necessary ACL rights to access specific fields requested during read or search_read operations. This decoupling of the execution capability from the field-level authorization logic allows the bypass.\nThe exploitation flow begins when an attacker or a prompt-injected agent constructs a payload targeting the execute_method function. The attacker specifies a model and a method, such as read or search_read, passing a list of sensitive fields in the argument payload.\nBecause the server-side logic in Odoo MCP 1.0.0 to 1.3.2 does not perform a secondary check against the Odoo ORM (Object-Relational Mapping) field security constraints after invoking the method, the data is retrieved and returned in an unredacted state to the caller.\nThis vulnerability effectively elevates the privileges of the MCP client, granting read access to attributes that are explicitly denied in the Odoo security backend.\nThe impact is a full disclosure of any data reachable via the read or search_read methods on any model the client has general access to, regardless of field-level restrictions defined in the system's security rules.\nThere is no requirement for administrative privileges; standard user credentials assigned to an MCP client suffice to initiate the request, provided the client has permission to utilize the execute_method tool itself. The exposure is persistent across any deployment using the affected MCP versions where field-level security is a critical control."
}