CVE-2026-122007

MEDIUM 6.5

Oqtane Framework before 10.3.0 Broken Access Control via SettingController

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.

CWE	CWE-639
Vendor	oqtane
Product	oqtane.framework
Published	Nov 4, 2026
Last Updated	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for oqtane oqtane.framework

Be the first to know when new medium vulnerabilities affecting oqtane oqtane.framework are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

oqtane / oqtane.framework

1.0.0 < 10.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0 oqtane.org: https://www.oqtane.org/blog/!/160/oqtane-10-3-released vulncheck.com: https://www.vulncheck.com/advisories/oqtane-framework-before-broken-access-control-via-settingcontroller

Credits

Mansurzhan Mavlankulov