CVE-2026-111616 Details

An authorization bypass vulnerability has been identified in the Oqtane Framework, affecting versions through 10.2.6. The issue resides in the SettingController, where site administrators can access private settings of co-tenant sites. Administrators on one site can exploit this vulnerability to retrieve sensitive information, such as SMTP credentials, from another site's private settings. The vulnerability arises because the authorization checks do not properly restrict access to site-specific data within a shared tenant environment.

To address this vulnerability, Oqtane Framework should implement proper authorization checks that verify the entityId belongs to the current site before allowing access to private settings. Additionally, private settings should be stored encrypted and not returned in cleartext through the API.