Answer in brief
CVE-2026-111616 records a Medium severity (CVSS 6.9) vulnerability in Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API. The current sources do not mark it as known exploited. The current feed maps Oqtane/Oqtane Framework (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Oqtane/Oqtane Framework (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Oqtane/Oqtane Frameworkgeneric | >=0 <=10.2.6 | Not reported |
Published upstream
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
Quoted source text, attributed separately from HOL analysis.