CVE-2026-126156 A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may...
CriticalCVSS 9.1
- Published
- Updated
- Exploit status
- No public exploit known
Description
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortimail | >= 8.0.0, <= 8.0.1 | No fix listed |
| fortinet fortimail | >= 7.6.0, <= 7.6.6 | No fix listed |
| fortinet fortimail | >= 7.4.0, <= 7.4.8 | No fix listed |
| fortinet fortimail | >= 7.2.0, <= 7.2.9 | No fix listed |