Improper Authorization in FortiOS and FortiProxy - CVE-2025-54822
Published: October 14, 2025
Vulnerability identifier: #VU117139
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-54822
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Fortinet, Inc
Affected software:
FortiOS
FortiProxy
FortiOS
FortiProxy
Detailed vulnerability description
The vulnerability allows a remote authenticated user to gain access to sensitive information.
The vulnerability exists due to improper authorization. An authenticated attacker can access static files of others VDOMs via crafted HTTP or HTTPS requests.
How to mitigate CVE-2025-54822
Install update from vendor's website.