Threats tagged 'ghsa-mq53-5f2v-2rj6'

Oqtane Framework versions prior to 10.3.0 have a broken access control vulnerability in SettingController.cs. This flaw allows an authenticated site administrator to read and modify settings of other sites within the same tenant database by supplying arbitrary entity IDs for Site or Role settings. The vulnerability arises because authorization checks do not verify that the requested site matches the current alias SiteId. Exploitation can disclose sensitive configuration values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and can alter another site's OIDC/OAuth2 authentication settings without requiring host-level privileges.