CVE-2026-25137

Deeper analysis

CVE-2026-25137 affects the NixOS Odoo package, an open-source ERP and CRM system, in versions from 21.11 up to but not including 25.11 and 26.05. The vulnerability stems from the public exposure of Odoo's database manager interface without any authentication mechanism. In typical non-NixOS setups, a master password provides a secondary defense, but NixOS's immutable configuration prevents Odoo from modifying its own config file to persist an auto-generated or manually set password. As a result, the password is lost on service restarts, leaving the database manager accessible without credentials. This issue is scored at CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) and maps to CWE-306 (Missing Authentication for Critical Function) and CWE-552 (Files or Directories Accessible to External Parties).

Any unauthenticated attacker with network access to the affected NixOS Odoo instance can exploit this by navigating to the /web/database endpoint. Successful exploitation enables full unauthorized read, download, or deletion of the entire database, including Odoo's file store. No privileges, user interaction, or administrative action are required, making it remotely exploitable over the network with low complexity.

NixOS security advisories and patches, detailed in GHSA-cwmq-6wv5-f3px and related nixpkgs pull requests #485310 and #485454, confirm the fix in Odoo package versions 25.11 and 26.05. Administrators should upgrade to these versions immediately. For detection, review access logs and Odoo logs for requests to /web/database, which indicate potential exploitation attempts.

Indicators from HTTP requests to /web/database can reveal prior unauthorized access, though no widespread real-world exploitation has been reported in the available data.