CVE-2026-111616: Oqtane Framework 0 through 10.2.6

Affected technology

Oqtane Framework · 0 through 10.2.6
Oqtane

Description’s affected range: through 10.2.6

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as high; integrity and availability impact as none.