Live › vulnerability › CVE-2026-111616
Go to dashboardOqtane Framework through 10.2.6 has an authorization bypass in SettingController that lets a site administrator request another tenant site's settings by entityId. An attacker with administrator rights on one site can retrieve stored SMTPPassword and SMTPClientSecret values belonging to a different site on the same installation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only installations of Oqtane Framework through 10.2.6 that host more than one site on the same instance are exposed, since the flaw lets an administrator of one site read another site's settings. Single-site installations have no co-tenant to read from, and the sources do not say whether they are safe beyond that.
No product ranges from the sources yet.
unknown for the exact package path; look for the Oqtane.Framework package version in the project's .csproj or packages.config, and compare against 10.2.6.unknown for the exact setting path; the sources do not say.10.2.6; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
This page as .md · .json · in your agent: get_signal("CVE-2026-111616")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.