What is the CVSS score of CVE-2026-25137?

CVE-2026-25137 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-25137?

Within 24 hours: Audit network access logs for unauthorized database manager access; take affected Odoo instances offline or restrict network access to trusted IPs only; notify affected stakeholders and legal/compliance teams. Within 7 days: Implement WAF rules blocking unauthenticated database manager endpoints; deploy network segmentation to isolate Odoo systems; conduct forensic analysis of access logs to determine if unauthorized access occurred. Within 30 days: Upgrade to patched Odoo versions (25.11+ or 26.05+) on new NixOS deployments; implement database encryption and access monitoring; establish incident response procedures for future critical vulnerabilities.

CVE-2026-25137

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-02-02 security-advisories@github.com

Authentication Bypass

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 23:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05.