CVE-2026-122007: Oqtane Framework before 10.3.0 Broken Access Control via SettingController
Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oqtane Frameworkto a version that resolves this vulnerability.Fixed in 10.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator of any site can exploit it against other sites that share the same tenant database. Host privileges are not required.
What access does an attacker need?
The attacker needs valid authentication as a site administrator and access to the /api/setting endpoints. They can supply an arbitrary entityId when requesting Site- or Role-type settings.
Are sensitive values exposed?
Yes. The issue can disclose private settings from other sites, including SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret values.
Can the vulnerability be used to change another site's configuration?
Yes. A site administrator can modify settings belonging to another site in the same tenant database, including OIDC/OAuth2 authentication configuration.
What version fixes the issue?
Upgrade to Oqtane Framework 10.3.0 or later. The vulnerability affects versions before 10.3.0.