SB2026111192 - Authorization bypass through user-controlled key in FortiMail

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111192

SB2026111192 - Authorization bypass through user-controlled key in FortiMail

Published: November 11, 2026

Security Bulletin ID SB2026111192
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-126152)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to damange or delete data.

The vulnerability exists due to authorization bypass through user-controlled key. An authenticated remote attacker can delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces.


Remediation

Install update from vendor's website.

References