Oqtane Framework
Monthly
Oqtane Framework through 10.2.6 exposes one tenant's stored private settings to the administrator of another tenant, allowing an authenticated site administrator to retrieve SMTPPassword and SMTPClientSecret values by requesting a foreign site's entityId through their own site alias. The flaw is an authorization bypass in SettingController (CWE-639, user-controlled key), scored 6.9 Medium under CVSS 4.0 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) and assessed as CVSS 3.1 6.0-style confidentiality-only impact (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Exploitation requires a multi-tenant Oqtane deployment hosting more than one site plus the attacker already holding the Administrators role on at least one tenant site; single-site installations are unaffected, no public exploit identified at time of analysis, and the impact is limited to credential disclosure with no integrity, availability, or code-execution effect (vendor advisory: https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api).
Oqtane Framework through 10.2.6 exposes one tenant's stored private settings to the administrator of another tenant, allowing an authenticated site administrator to retrieve SMTPPassword and SMTPClientSecret values by requesting a foreign site's entityId through their own site alias. The flaw is an authorization bypass in SettingController (CWE-639, user-controlled key), scored 6.9 Medium under CVSS 4.0 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) and assessed as CVSS 3.1 6.0-style confidentiality-only impact (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Exploitation requires a multi-tenant Oqtane deployment hosting more than one site plus the attacker already holding the Administrators role on at least one tenant site; single-site installations are unaffected, no public exploit identified at time of analysis, and the impact is limited to credential disclosure with no integrity, availability, or code-execution effect (vendor advisory: https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api).