Any user can read the hashed password
While reading \[1\]\, I was wondering if trytond was also affected\. \
Indeed series \<\=3\.0 are not affected but rc9be44cd05e1 removed the protection by mistake\. The new password\_hash field did not received the same hiding treatment as the password field\. \
The exploitation is quite difficult because of the existing protections against such leak\. The protections are the usage of strong hash \(bcrypt and sha1\) and the random salt\. \
\
\[1\] https\:\/\/github\.com\/odoo\/odoo\/issues\/13175
issue