CVE-2026-122007

    Dashboard / Vulnerabilities / CVE-2026-122007

    CVE-2026-122007

    Published: 4 Nov 2026Last Modified: 5 Nov 2026

    Summary: Oqtane Framework before 10.3.0 Broken Access Control via SettingController

    Details: Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122007.json, https://nvd.nist.gov/vuln/detail/CVE-2026-122007, https://www.oqtane.org/blog/!/160/oqtane-10-3-released, https://www.vulncheck.com/advisories/oqtane-framework-before-broken-access-control-via-settingcontroller, https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0, https://github.com/oqtane/oqtane.framework

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c33a842f3e3992a79dc6c703c09c461f1b3b8d41

    Affected versions

    v10.2.6
    v10.2.5
    v10.2.4
    v10.2.3
    v10.2.2
    v10.2.1
    v10.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-122007 | CVE-DB