Read the docs

oqtane

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

oqtane records in CISA KEV

No oqtane vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-85078 CVE-2026-122007 · GHSA-mq53-5f2v-2rj6

Broken access control in Oqtane Framework settings API exposes other sites

Priority LOW 35

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same t…

CVSS 4.0HIGH 7.4 Network High privileges No interaction EPSS 0.00383 Published 2026-11-04 Fixed in 10.3.0 CWE-639
TI-2026-75402 CVE-2026-111616 · GHSA-cc9f-f98j-3ppq

Authorization bypass in Oqtane exposes other sites' SMTP secrets

Priority LOW 30

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00346 Published 2026-10-16 No fix listed CWE-639
TI-2026-85079 CVE-2026-122008 · GHSA-p838-xx56-rf99

Server-side request forgery in Oqtane Framework file upload from URL

Priority LOW 24

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by su…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00259 Published 2026-11-04 Fixed in 10.3.0 CWE-918
Open these records in search →