PT-2026-116015 · Oqtane · Oqtane Framework
CVSS v3.1
4.9
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Oqtane Framework