The vulnerability is an authorization bypass in the SettingController that allows an administrator on one tenant to read private configuration values—including SMTP credentials—of another tenant. This flaw arises from improper ownership checks in the API. The weakness corresponds to CWE‑639, where authenticated users can access data belonging to other users.

It affects the Oqtane Framework version 10.2.6 and earlier, specifically the SettingController component that processes cross‑tenant setting requests.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an account with the Administrators role on a tenant; the attacker can supply another tenant’s entityId via the alias parameter to retrieve sensitive settings. While the attack is confined to privileged users, the exposed credentials could lead to broader compromise of the affected system’s mail services or internal communications.