{"id":"CVE-2026-122007","kind":"vulnerability","aliases":["CVE-2026-122007"],"related":[],"title":"Oqtane Framework: site admins can read and change other sites' settings","description":"Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.","summary":"Oqtane Framework before 10.3.0 lets an authenticated site administrator pass an arbitrary entityId to the /api/setting endpoints and read or modify settings of other sites in the same tenant database. Exposed values include SMTP passwords, SMTP client secrets and external login client secrets, and an attacker can alter another site's OIDC/OAuth2 authentication configuration.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asp.net","dotnet","multi-tenant","oqtane","runtime","self-hosted"],"not_affected_if":["host-only-admins","single-site","version-10.3.0-or-later"],"how_to_check":"- Check the installed Oqtane version and confirm whether it is below `10.3.0`\n- Confirm whether the deployment runs several sites in one tenant database","fix":"- Move Oqtane Framework to `10.3.0` or later","status":"open","published_at":"2026-11-04T15:17:43+00:00","first_seen_at":"2026-11-04T15:27:31+00:00","triaged_at":"2026-11-04T15:28:24+00:00","updated_at":"2026-11-04T15:28:24+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-04T15:28:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oqtane Framework to `10.3.0` or later","reach":"network","title":"Oqtane Framework: site admins can read and change other sites' settings","impact":"high","summary":"Oqtane Framework before 10.3.0 lets an authenticated site administrator pass an arbitrary entityId to the /api/setting endpoints and read or modify settings of other sites in the same tenant database. Exposed values include SMTP passwords, SMTP client secrets and external login client secrets, and an attacker can alter another site's OIDC/OAuth2 authentication configuration.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["oqtane","dotnet","asp.net","multi-tenant","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Site admin reads SMTP and OAuth secrets from other sites","analyst_note":"","how_to_check":"- Check the installed Oqtane version and confirm whether it is below `10.3.0`\n- Confirm whether the deployment runs several sites in one tenant database\n- unknown whether the sources give further checks","plain_action":"","needs_analyst":false,"not_affected_if":["single-site","version-10.3.0-or-later","host-only-admins"],"who_is_affected":"Any deployment of Oqtane Framework before 10.3.0 that hosts more than one site in the same tenant database is exposed, since the flaw lets a site administrator reach another site's settings. Single-site installs with no other site admins have a much smaller exposure. unknown whether the sources name other preconditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4283,"output_tokens":590,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122007':14A,17A '-2026':13A,16A '/api/setting':43B,144C '10.3.0':31B,85C 'access':89C 'admin':4A 'administr':36B,99C 'alia':138C 'allow':95C 'alter':75B,159C 'anoth':76B,160C 'arbitrari':39B,117C 'asp.net':18B 'attack':73B,140C 'authent':34B,80B,97C,164C 'belong':105C 'broken':88C 'chang':8A 'client':64B,69B 'clientsecret':156C 'configur':81B,165C 'contain':86C 'control':90C 'current':137C 'cve':12A,15A 'databas':57B,113C 'disclos':147C 'dotnet':19B 'endpoint':44B,145C 'entityid':40B,118C 'exploit':142C 'expos':58B 'extern':67B 'externallogin':155C 'fail':129C 'filterpriv':128C 'framework':2A,29B,83C 'host':27B,168C 'includ':60B 'isauthor':126C 'let':32B 'login':68B 'match':135C 'modifi':48B,103C 'multi':21B 'multi-ten':20B 'oidc/oauth2':79B,163C 'oqtan':1A,23B,28B,82C 'pass':37B 'password':62B 'privat':148C 'privileg':169C 'read':6A,46B,101C 'request':133C 'requir':167C 'role':122C 'runtim':24B 'secret':65B,70B 'self':26B 'self-host':25B 'set':11A,49B,104C,124C 'settingcontroller.cs':93C 'sinc':125C 'site':3A,10A,35B,52B,77B,98C,108C,120C,134C,161C 'siteid':139C 'smtp':61B,63B 'smtpclientsecret':153C 'smtppassword':152C 'suppli':115C 'tenant':22B,56B,112C 'type':123C 'valu':59B,149C 'verifi':131C 'vulner':91C 'within':109C 'without':166C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Oqtane Framework before 10.3.0 that hosts more than one site in the same tenant database is exposed, since the flaw lets a site administrator reach another site's settings. Single-site installs with no other site admins have a much smaller exposure. unknown whether the sources name other preconditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnet","dotnet","high","multitenant","oqtane","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122007","severity":null,"published_at":"2026-11-04T15:17:43+00:00","modified_at":"2026-11-04T15:17:43+00:00","first_seen_at":"2026-11-04T15:27:31+00:00","fetched_at":"2026-11-04T15:27:31+00:00","note":null}],"documents":[{"id":67843,"url":"https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":67844,"url":"https://www.vulncheck.com/advisories/oqtane-framework-before-broken-access-control-via-settingcontroller","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}