EUVD-2026-103038
GHSA-cc9f-f98j-3ppq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Administrator on own tenant site
-
ExploitCall Setting API with another site's entityId via own alias
-
ExecutionBypass SettingController authorization check
-
ImpactExfiltrate victim SMTPPassword and SMTPClientSecret
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a multi-tenant Oqtane deployment hosting more than one site, and the attacker must already hold the Administrators role on at least one of those tenant sites (PR:H). The concrete trigger is requesting another site's entityId through the attacker's own site alias against the Setting API, which SettingController fails to scope to the requesting tenant. Limiting factors that reduce real-world exposure: single-tenant or single-site installations are not affected, the attacker needs a valid site-admin account, and the flaw discloses stored settings (SMTP credentials) only - it grants no code execution, integrity, or availability impact. |
| Impact | The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) yields a 6.9 Medium score, and an independent read supports a mid-tier real-world risk rather than an emergency. The strongest mitigating signal is PR:H: exploitation requires the attacker to already hold the Administrators role on a tenant site, so this is not a pre-auth internet-wide threat but a cross-tenant trust-boundary violation relevant only to shared/multi-tenant Oqtane hosting. Offsetting that, AV:N/AC:L/UI:N mean that once an attacker has any site-admin foothold the disclosure is trivial and repeatable, and the impact (VC:H - theft of stored SMTPPassword and SMTPClientSecret) enables meaningful follow-on abuse such as email spoofing or OAuth client takeover. No EPSS score, KEV listing, or SSVC decision data was supplied, so probabilistic and framework-based signals are MISSING rather than low; absence of KEV should not be read as 'safe.' A detailed third-party technical write-up (hackmd) and a direct link to the vulnerable SettingController source lines exist, which materially lowers the bar to reproduce the flaw even though no packaged/weaponized exploit is confirmed. Net: a genuine priority for anyone running multi-tenant Oqtane, but low broad-population urgency given single-site and self-hosted single-tenant deployments are largely unaffected. |
| Exploit ScenarioDerived | In a shared multi-tenant Oqtane deployment, an attacker who controls the Administrators role on their own tenant site issues a Setting API request referencing a victim tenant's entityId through the attacker's own alias, bypassing the authorization check in SettingController to read the victim's private settings and exfiltrate stored SMTPPassword and SMTPClientSecret values. A public technical write-up and the vulnerable source lines are available, lowering reproduction effort, though no weaponized exploit is confirmed at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Oqtane Framework through 10.2.6 exposes one tenant's stored private settings to the administrator of another tenant, allowing an authenticated site administrator to retrieve SMTPPassword and SMTPClientSecret values by requesting a foreign site's entityId through their own site alias. The flaw is an authorization bypass in SettingController (CWE-639, user-controlled key), scored 6.9 Medium under CVSS 4.0 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) and assessed as CVSS 3.1 6.0-style confidentiality-only impact (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Exploitation requires a multi-tenant Oqtane deployment hosting more than one site plus the attacker already holding the Administrators role on at least one tenant site; single-site installations are unaffected, no public exploit identified at time of analysis, and the impact is limited to credential disclosure with no integrity, availability, or code-execution effect (vendor advisory: https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api).
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must initially be compensating: treat the Setting API endpoints as a trust boundary and ensure SettingController scopes every lookup to the tenant derived from the caller's own site alias rather than to a caller-supplied entityId - this is the code-level fix that upstream must ship, and a temporary patch or reverse-proxy filter that rejects requests whose entityId does not resolve to the caller's tenant reproduces it (side effect: legitimate cross-tenant administrative tooling, if any, will break). Immediately rotate every SMTPPassword and SMTPClientSecret value stored in any tenant settings on shared instances, since any site administrator could already have harvested them, and replace shared or high-privilege SMTP relay credentials with per-site, least-privilege accounts so a future disclosure yields only a scoped mail sender (side effect: more credentials to manage and per-site mail configuration overhead). Strongly restrict who holds the Administrators role on each tenant, and avoid hosting mutually untrusted tenants on a single Oqtane instance; if that is not possible, isolate tenants onto separate deployments or separate application pools and databases, which removes the shared-settings attack surface entirely (side effect: increased infrastructure and operational cost). Finally, monitor and alert on Setting API requests whose entityId does not match the requesting site's tenant, and align any such detections with the advisory references at https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api and https://github.com/oqtane/oqtane.framework/blob/v10.2.6/Oqtane.Server/Controllers/SettingController.cs#L411-L516; have a documented rollback path because an outbound-mail outage from a botched settings change is the most likely operational side effect of tightening these endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oqtane is an open-source, multi-tenant Blazor/.NET application framework in which each hosted site is a separate tenant with its own settings persisted through the Setting API. CWE-639 (Authorization Bypass Through User-Controlled Key) is the root cause class here: SettingController at Oqtane.Server/Controllers/SettingController.cs (lines 411-516 in v10.2.6) accepts an entityId supplied by the caller and returns settings without verifying that the referenced entity belongs to the tenant resolved from the caller's site alias. Because the tenant boundary is enforced only by which alias the request is issued against, and not by an ownership check on the requested key, an administrator of Site A can pass Site B's entityId and read Site B's private configuration, including stored SMTPPassword and SMTPClientSecret values used for outbound mail authentication. The CPE cpe:2.3:a:oqtane:oqtane_framework:*:*:*:*:*:*:*:* confirms all released Framework versions up to and including 10.2.6 are in scope. This is an IDOR-style horizontal privilege escalation across tenants rather than a remote unauthenticated compromise: the CVSS vector carries PR:H, so the actor must already be an authenticated privileged site administrator, and the vector shows only a confidentiality impact (VC:H with VI:N/VA:N and no subsequent-system impact), consistent with credential disclosure rather than code execution or data tampering.
Know when Oqtane Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remotely reachable with low complexity (AV:N/AC:L) but needs an authenticated Administrators-role account (PR:H), no user interaction, and only credential confidentiality is affected so C:H, I:N, A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB