CVE-2026-111616: Authorization Bypass Through User-Controlled Key in Oqtane Oqtane Framework

CVE-2026-111616 describes an authorization bypass vulnerability in the Oqtane Framework's SettingController component affecting versions up to 10.2.6. The vulnerability enables an attacker who has Administrator privileges on one tenant site to request another site's entityId via their own alias, thereby accessing private configuration settings of the other site. This includes sensitive SMTP credentials like SMTPPassword and SMTPClientSecret, which should be protected. The CVSS 4.0 base score is 6.9, indicating a medium severity issue with network attack vector, low attack complexity, and high impact on confidentiality.

An attacker with Administrator privileges on one tenant site can bypass authorization controls to read private settings of other co-tenant sites. This exposure includes sensitive SMTP credentials, potentially compromising email communications and related services. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator role assignments to trusted users only and monitor access to sensitive settings. Avoid sharing administrative privileges across tenants. Follow vendor updates closely for patches addressing this vulnerability.