Critical · published February 2, 2026
🚨 A gaping hole in NixOS's Odoo package leaves your database manager exposed to anyone who can find it — no password required! 🔥 Think of it as leaving the door to your office wide open while the priceless client files are stacked on the desk, completely unguarded. Anyone walking by can just stroll in and walk away with everything. An unauthorized actor could waltz right in and not just peek at your sensitive data, but also delete or download your entire database, including vital files. This could lead to devastating data loss, operational downtime, and potential legal issues if customer data is compromised.
Think of it as leaving the door to your office wide open while the priceless client files are stacked on the desk, completely unguarded. Anyone walking by can just stroll in and walk away with everything. The vulnerability allows unauthenticated access to the Odoo database manager in NixOS setups from versions 21.11 to before 25.11 and 26.05, making it possible for attackers to manipulate the database without any authentication safeguards.
An unauthorized actor could waltz right in and not just peek at your sensitive data, but also delete or download your entire database, including vital files. This could lead to devastating data loss, operational downtime, and potential legal issues if customer data is compromised. Immediately upgrade to Odoo version 25.11 or 26.05 to patch this vulnerability. Additionally, check your access logs for any suspicious requests to /web/database; if found, ensure to take necessary actions to secure your data. You've got this! By following these steps, you'll lock down your system and restore your security hero status! 🛡️