Broken Access Control in Oqtane Framework Allows Unauthorized Access to Settings

CVE-2026-122007

What is CVE-2026-122007?

Oqtane Framework prior to version 10.3.0 contains a significant vulnerability in its SettingController.cs, enabling an authenticated site administrator to access and modify other sites' settings within the same tenant database. This issue arises from the failure of critical authorization checks that should ensure requested sites correspond to the current alias SiteId. By exploiting the /api/setting endpoints, attackers can retrieve sensitive information such as SMTP credentials and manipulate OIDC/OAuth2 authentication configurations of other sites, thereby posing a considerable risk to data privacy and integrity.

References