{"id":"CVE-2026-111616","title":"Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API","summary":"Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site ca…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"Oqtane","product":"Oqtane Framework","affected":["framework <= 10.2.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T19:33:55.706755Z"},"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T21:19:35.462Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111616","references":[{"url":"https://hackmd.io/@hieuPenguinnn/oqtane-setting-site-cross-site-private-settings-idor"},{"url":"https://github.com/oqtane/oqtane.framework/blob/v10.2.6/Oqtane.Server/Controllers/SettingController.cs#L411-L516"},{"url":"https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api","label":"VulnCheck Advisory: Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T18:43:08.693Z","slug":"CVE-2026-111616","body":"## Overview\n\nOqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.\n\n## Affected\n\n- `framework <= 10.2.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}