CVE-2026-122007

The Oqtane Framework (versions prior to 10.3.0 ) is vulnerable to a broken access control issue in SettingController.cs . The root cause is that the IsAuthorized and FilterPrivate methods fail to verify if a requested site matches the current alias SiteId . This allows an authenticated site admin...