Medium severity4.9NVD Advisory· Published Oct 16, 2026· Updated Oct 16, 2026

CVE-2026-111616

Description

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.

Affected products

Oqtane/Oqtane.frameworkllm-fuzzy
Range: <=10.2.6

Patches

Vulnerability mechanics

References

github.com/oqtane/oqtane.framework/blob/v10.2.6/Oqtane.Server/Controllers/SettingController.csnvd
hackmd.io/@hieuPenguinnn/oqtane-setting-site-cross-site-private-settings-idornvd
www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-apinvd

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000