---
id: "CVE-2026-122007"
kind: "vulnerability"
aliases: ["CVE-2026-122007"]
title: "Oqtane Framework: site admins can read and change other sites' settings"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["asp.net", "dotnet", "multi-tenant", "oqtane", "runtime", "self-hosted"]
not_affected_if: ["host-only-admins", "single-site", "version-10.3.0-or-later"]
published_at: "2026-11-04T15:17:43+00:00"
first_seen_at: "2026-11-04T15:27:31+00:00"
updated_at: "2026-11-04T15:28:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122007", "first_seen_at": "2026-11-04T15:27:31+00:00"}]
---

# Oqtane Framework: site admins can read and change other sites' settings

Oqtane Framework before 10.3.0 lets an authenticated site administrator pass an arbitrary entityId to the /api/setting endpoints and read or modify settings of other sites in the same tenant database. Exposed values include SMTP passwords, SMTP client secrets and external login client secrets, and an attacker can alter another site's OIDC/OAuth2 authentication configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oqtane version and confirm whether it is below `10.3.0`
- Confirm whether the deployment runs several sites in one tenant database

## Fix

- Move Oqtane Framework to `10.3.0` or later

## Timeline

- 2026-11-04T15:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122007

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/oqtane-framework-before-broken-access-control-via-settingcontroller
- [fix] Release notes: github.com https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0

## From the sources

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_