CVE-2026-111616: Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the Administrators role on one Oqtane site. The issue affects co-tenanted sites because that administrator can target another site's entityId while using an alias associated with their own site.
What information could be exposed?
The disclosed private settings can include stored SMTPPassword and SMTPClientSecret values. The vulnerability is an information disclosure issue; the provided data does not indicate integrity or availability impact.
How can I determine whether my deployment is affected?
Deployments running Oqtane Framework through 10.2.6 are in scope. A practical validation is to determine whether a site administrator can use their own site alias with another co-tenant site's entityId to retrieve that site's private settings through the Setting API.