Oqtane Framework before 10.3.0 Broken Access Control via SettingController
Oqtane Framework versions from 1.0.0 before 10.3.0 are affected when Site or Role type settings are reached with an arbitrary entityId. The fix is in 10.3.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 10.3.0
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Oqtane Framework versions from 1.0.0 before 10.3.0 are affected The bug is hit through Site or Role type settings using an arbitrary entityId
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.4/10CVSS 7.4, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 66 if added to CISA KEV
- Would score about 61 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
CVE-2026-122007 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.4 (high) and affects oqtane.framework; fixed in 10.3.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 16/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 10.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Oqtane Framework has a broken access control flaw in its settings API that lets a logged-in site administrator read and change settings belonging to other sites in the same database, including SMTP passwords and login client secrets, and alter other sites' OIDC or OAuth2 sign-in configuration. It can be triggered remotely over the network by someone who already holds site administrator credentials, without needing host-level privileges.
Read the original description
Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.
What to do
Check whether your setup matches what the bug needs.
Oqtane Framework versions from 1.0.0 before 10.3.0 are affected The bug is hit through Site or Role type settings using an arbitrary entityIdUpgrade to a fixed version: 10.3.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- oqtane oqtane.framework
From 1.0.0 · fixed in 10.3.0
Evidence 3
- Patch
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-122007
Is CVE-2026-122007 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Supplying an arbitrary entityId for Site or Role type settings lets a request read and change settings that belong to other sites in the same tenant database. This can disclose private values such as SMTP passwords and client secrets, and can alter another site's OIDC/OAuth2 authentication configuration.Source: vulncheck.com, github.com
Which versions are affected by CVE-2026-122007?
oqtane.framework: from 1.0.0 before 10.3.0.Source: cve.now feed data
Am I affected, and how do I check?
Oqtane Framework versions from 1.0.0 before 10.3.0 are affected, and the bug is reached through Site or Role type settings. To check an installation, look up the oqtane.framework version it runs, such as the package version in the project or deployment configuration.Source: vulncheck.com, github.com
How do I fix CVE-2026-122007?
Upgrade to Oqtane Framework 10.3.0, which contains the fix. The advisory lists 10.3.0 as the fixed version and no workaround is given.Source: vulncheck.com, github.com