Axelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such as roles and group by submitting changes through a related entity's save path, bypassing the USER_RESTRICTED_FIELDS control and causing the JPA persistence layer to flush attacker-supplied admin role and group assignments on commit.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA axelor-open-platform (axelor) Fixed in 8.2.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63085
- 2026-10-03 Alias added: GHSA-fgwg-8qwr-qvw3
References
Exploit 1
More axelor vulnerabilities
- TI-2022-08857 Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-63085 · CVE Program
- CVE-2026-63085 · NVD
- FIRST EPSS
- GHSA-fgwg-8qwr-qvw3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences