# CVE-2026-122007: Oqtane Framework before 10.3.0 Broken Access Control via SettingController

Status: published. Published: 2026-11-04. Updated: 2026-11-04.

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: VulnCheck) — https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0

## Affected products and versions

- oqtane / oqtane.framework (oqtane/oqtane.framework): ≥ 1.0.0; < 10.3.0 (affected, semver). Source: CNA: VulnCheck

## Severity and prioritization

- CVSS 4.0: 7.4 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: VulnCheck

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N; source: CNA: VulnCheck

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-639

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0 (CNA: VulnCheck; patch)

- https://www.oqtane.org/blog/!/160/oqtane-10-3-released (CNA: VulnCheck; release-notes)

- https://www.vulncheck.com/advisories/oqtane-framework-before-broken-access-control-via-settingcontroller (CNA: VulnCheck; third-party-advisory)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2026-122007; retrieved 2026-11-04; source updated 2026-11-04

Revision: f0f187abffea499f363c3cb9a743ffe9a40529e277e9b41dc957fc13c896fccb

Canonical: https://y2.dev/cve/CVE-2026-122007

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.