---
id: CVE-2026-111616
title: Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API
summary: >-
  Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability
  in SettingController that allows a site administrator to read another
  co-tenant site's private settings. Attackers with the Administrators role on
  one site ca…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Oqtane
product: Oqtane Framework
affected:
  - framework <= 10.2.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:33:55.706755Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T21:19:35.462Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111616'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/oqtane-setting-site-cross-site-private-settings-idor
  - url: >-
      https://github.com/oqtane/oqtane.framework/blob/v10.2.6/Oqtane.Server/Controllers/SettingController.cs#L411-L516
  - url: >-
      https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api
    label: >-
      VulnCheck Advisory: Oqtane Framework through 10.2.6 Cross-Site Settings
      Disclosure via Setting API
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.693Z'
---

## Overview

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.

## Affected

- `framework <= 10.2.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.