{"id":"CVE-2026-111616","kind":"vulnerability","aliases":["CVE-2026-111616"],"related":[],"title":"Oqtane Framework: site admins can read another site's SMTP passwords","description":"Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.","summary":"Oqtane Framework through 10.2.6 has an authorization bypass in SettingController that lets a site administrator request another tenant site's settings by entityId. An attacker with administrator rights on one site can retrieve stored SMTPPassword and SMTPClientSecret values belonging to a different site on the same installation.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","multi-tenant","oqtane","package","self-hosted"],"not_affected_if":["auth-required","single-site"],"how_to_check":"- Check the installed Oqtane version: `unknown` for the exact package path; look for the Oqtane.Framework package version in the project's `.csproj` or `packages.config`, and compare against `10.2.6`.\n- Check whether the installation hosts more than one site (multi-tenant) with `unknown` for the exact setting path; the sources do not say.","fix":"- Oqtane Framework: upgrade to a release later than `10.2.6`; the sources do not name the fixed version.\n- Rotate SMTP passwords and SMTPClientSecret values stored in any site's settings if other tenants had administrator access.","status":"open","published_at":"2026-10-16T18:17:41+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:30+00:00","updated_at":"2026-10-25T03:42:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:30Z","model":"claude-haiku-5-5","output":{"fix":"- Oqtane Framework: upgrade to a release later than `10.2.6`; the sources do not name the fixed version.\n- Rotate SMTP passwords and SMTPClientSecret values stored in any site's settings if other tenants had administrator access.","reach":"internet","title":"Oqtane Framework: site admins can read another site's SMTP passwords","impact":"medium","summary":"Oqtane Framework through 10.2.6 has an authorization bypass in SettingController that lets a site administrator request another tenant site's settings by entityId. An attacker with administrator rights on one site can retrieve stored SMTPPassword and SMTPClientSecret values belonging to a different site on the same installation.","category":"package","nicknames":[],"who_cares":["oqtane","dotnet","multi-tenant","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Another site's SMTP passwords and client secrets are readable by a site admin","analyst_note":"Find the fixed Oqtane version and confirm the patched release at the project's GitHub advisory or NVD references; the sources give no fix version.","how_to_check":"- Check the installed Oqtane version: `unknown` for the exact package path; look for the Oqtane.Framework package version in the project's `.csproj` or `packages.config`, and compare against `10.2.6`.\n- Check whether the installation hosts more than one site (multi-tenant) with `unknown` for the exact setting path; the sources do not say.","needs_analyst":true,"not_affected_if":["single-site","auth-required"],"who_is_affected":"Only installations of Oqtane Framework through 10.2.6 that host more than one site on the same instance are exposed, since the flaw lets an administrator of one site read another site's settings. Single-site installations have no co-tenant to read from, and the sources do not say whether they are safe beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":3330,"output_tokens":678,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111616':14A,17A '-2026':13A,16A '10.2.6':30B,77C 'admin':4A 'administr':41B,53B,89C,103C 'alia':117C 'allow':86C 'anoth':7A,43B,92C,110C 'attack':51B,100C 'author':33B,80C 'belong':65B 'bypass':34B,81C 'co':94C 'co-ten':93C 'contain':78C 'cve':12A,15A 'differ':68B 'dotnet':18B 'entityid':49B,113C 'framework':2A,28B,75C 'host':26B 'instal':73B 'let':38B 'multi':20B 'multi-ten':19B 'one':56B,106C 'oqtan':1A,22B,27B,74C 'packag':23B 'password':11A 'privat':98C 'read':6A,91C 'request':42B,109C 'retriev':59B,119C 'right':54B 'role':104C 'self':25B 'self-host':24B 'set':47B,99C 'settingcontrol':36B,84C 'site':3A,8A,40B,45B,57B,69B,88C,96C,107C,111C 'smtp':10A 'smtpclientsecret':63B,123C 'smtppassword':61B,121C 'store':60B,120C 'tenant':21B,44B,95C 'valu':64B,124C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Only installations of Oqtane Framework through 10.2.6 that host more than one site on the same instance are exposed, since the flaw lets an administrator of one site read another site's settings. Single-site installations have no co-tenant to read from, and the sources do not say whether they are safe beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111616","severity":null,"published_at":"2026-10-16T18:17:41+00:00","modified_at":"2026-10-16T22:17:20+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}