CVE-2026-111616
MediumCVSS 4.9Summary
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
Risk Assessment
Leakage of SMTP credentials can enable takeover of outbound mail, sending spoofed messages on behalf of the organization, and further attack escalation. The risk affects environments hosting multiple Oqtane sites on a single instance.
Recommendation
Upgrade Oqtane Framework beyond 10.2.6 as soon as a fixed version is available, and immediately rotate SMTP passwords and secrets used by all sites. Consider limiting shared instances and auditing site administrator permissions.
Other vulnerabilities in Oqtane Framework
See all- CVE-2026-122008Medium
Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports.
- CVE-2026-122007Medium
Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.
Original NVD description (English source)
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS