Is CVE-2026-122007 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122007 being exploited in the wild.

How severe is CVE-2026-122007?

Medium severity, with a CVSS score of 6.5, published 4 November 2026.

Which products and versions are affected?

Oqtane Framework before 10.3.0.

Is there a fix for CVE-2026-122007?

Yes: fixed in 10.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122007 attacked?

It is attacked over the network.

Am I affected by CVE-2026-122007?

Check whether you run Oqtane Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122007: Oqtane Framework broken access control in SettingController

CVE-2026-122007 · Severity: medium · CVSS 6.5 · Published 2026-11-04

Oqtane Framework is a .NET-based CMS and application framework. An authenticated site administrator can bypass access controls in the settings API to read and modify configuration belonging to other sites in the same tenant, including stealing sensitive credentials like SMTP passwords and OAuth secrets, and altering authentication settings without host privileges.

Technologies: Oqtane Framework. Vendors: Oqtane.

Quick answers

Is CVE-2026-122007 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122007 being exploited in the wild.
How severe is CVE-2026-122007?: Medium severity, with a CVSS score of 6.5, published 4 November 2026.
Which products and versions are affected?: Oqtane Framework before 10.3.0.
Is there a fix for CVE-2026-122007?: Yes: fixed in 10.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122007 attacked?: It is attacked over the network.
Am I affected by CVE-2026-122007?: Check whether you run Oqtane Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 10.3.0

Technical details

The SettingController /api/setting endpoints fail to validate that the requested site matches the current alias SiteId, allowing an authenticated administrator to supply an arbitrary entityId to access and modify Site and Role type settings across different sites. The IsAuthorized and FilterPrivate methods do not perform site-scoping verification. This enables disclosure of secrets such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, as well as modification of OIDC/OAuth2 authentication configuration.

Affected products

Oqtane Framework before 10.3.0

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.