CVE-2026-63085

Name of the Vulnerable Software and Affected Versions Axelor Open Platform versions prior to 8.2.2

Description An authorization bypass allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields, specifically roles and group, by submitting changes through a related entity's save path. This process bypasses the USER RESTRICTED FIELDS control, causing the JPA (Java Persistence API) persistence layer to flush attacker-supplied admin role and group assignments upon commit.

Recommendations Update Axelor Open Platform to version 8.2.2 or later.