Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Odoo SA bug bounty programs

odoo.com Updated

Odoo SA runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.

Top reward
$1,500
Sorona
Programs
2
1 pays cash
Targets in scope
22
3 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Odoo Community

Sorona · Pays the most of the 2 programs: up to $1,500.
  • Odoo Community

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100 (highest)
    Safe harbor
    Partial
  • Odoo

    Self-hosted · Disclosure only

    Open

    Top reward

    No cash
    Safe harbor
    Full
    First response
    2 days promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

22 targets across all 2 programs, each listed once with the programs that cover it. 6 excluded.

  • demo.odoo.com

    Domains

    Covered by Self-hosted

  • odoo.com

    Domains

    Covered by Self-hosted

  • website builder

    Domains No bounty

    Covered by Self-hosted

  • www.odoo.com/app/website

    Domains No bounty

    Covered by Self-hosted

  • https://www.odoo.com

    Web

    Covered by Sorona

  • Attachments and the filestore, both the write path and the access check on retrieval

    Products and areas

    Covered by Sorona

  • Authentication modules in the Community tree, including LDAP and OAuth, plus API key handling and session management

    Products and areas

    Covered by Sorona

  • Mail, mass mailing and the inbound mail gateway, which processes messages from unauthenticated senders

    Products and areas

    Covered by Sorona

  • Multi-company record rules, where one database serves several legal entities and the separation between them is enforced in rules rather than in schema

    Products and areas

    Covered by Sorona

  • Payment provider modules and the callback or webhook route a gateway uses to report a completed transaction

    Products and areas

    Covered by Sorona

  • Point of sale, including its offline mode and the session data held on a client until it syncs

    Products and areas

    Covered by Sorona

  • The accounting and invoicing modules, including bank synchronisation and the payment reconciliation flow

    Products and areas

    Covered by Sorona

  • The database manager and the master password that protects database creation, duplication and backup

    Products and areas

    Covered by Sorona

  • The module installation and update mechanism, which loads new Python and XML into a running instance

    Products and areas

    Covered by Sorona

  • The ORM and its access-rights layer: model access rules, record rules and the field-level restrictions every module relies on for authorisation

    Products and areas

    Covered by Sorona

  • The portal, where an external user signs in to view their own quotations, invoices and tickets

    Products and areas

    Covered by Sorona

  • The published programme asks for any security issue in Odoo by email to [email protected], and the signed security.txt gives the same address for the whole product. No component carve-out is stated, so the Community source tree is in scope as a whole

    Products and areas

    Covered by Sorona

  • The QWeb template engine, used for reports, website pages and email, the main server-side template evaluation surface

    Products and areas

    Covered by Sorona

  • The web controller and RPC surface, covering the JSON-RPC and XML-RPC entry points that expose model methods to any authenticated caller

    Products and areas

    Covered by Sorona

  • The website builder and eCommerce modules, plus every public controller they expose to unauthenticated visitors

    Products and areas

    Covered by Sorona

  • your own deployments

    Products and areas

    Covered by Self-hosted

  • your own Odoo Cloud databases

    Products and areas

    Covered by Self-hosted

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Access rights or record rules an administrator configured deliberately

    Sorona

  • Deployment configuration, including an instance that leaves the database manager reachable in production

    Sorona

  • Enterprise-only modules, which are not published in the Community tree this entry covers

    Sorona

  • Odoo SA's own hosting and commercial SaaS infrastructure, which is the vendor's estate rather than the Community codebase

    Sorona

  • Third-party modules from the Odoo Apps store and from community collections such as the OCA repositories

    Sorona

  • Upstream Python dependency issues, unless Odoo's own use of the dependency is what makes the defect reachable

    Sorona

Recent changes

Reward and scope changes across every Odoo SA program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Odoo SA products, from the NVD.

Search NVD
  • CVE-2024-36259 High

    Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack.

  • CVE-2024-36259 High

    Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack.

  • CVE-2024-12368 High

    Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.

  • CVE-2024-12368 High

    Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.

  • CVE-2023-48050 Critical

    SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py component.

  • CVE-2023-48050 Critical

    SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py component.

  • CVE-2021-44547 Critical

    A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.

  • CVE-2021-44476 Medium

    A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files.

About this page

This page gathers every public program listed under odoo.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.