Authorization Bypass in Oqtane Framework by Oqtane

CVE-2026-111616

What is CVE-2026-111616?

The Oqtane Framework version 10.2.6 is susceptible to an authorization bypass vulnerability in the SettingController. This flaw enables site administrators to access private settings of other co-tenant sites. A malicious administrator can exploit this vulnerability to retrieve sensitive information such as SMTP passwords and client secrets by manipulating entity IDs in their requests, ultimately compromising the confidentiality of other tenants' configurations.

References