CVE-2026-111616
CVE-2026-111616 · Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
CVSS 6.9 · Mittel · EPSS 0,3%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
oqtane framework
- Softwareversionen
- ≥ 0, ≤ 10.2.6: Betroffen (custom)
Keine Korrektur veröffentlicht
Originalquellen
- https://hackmd.io/@hieuPenguinnn/oqtane-setting-site-cross-site-private-settings-idor
- https://github.com/oqtane/oqtane.framework/blob/v10.2.6/Oqtane.Server/Controllers/SettingController.cs#L411-L516
- https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-111616