Incorrect authorization in FortiMail - CVE-2026-126155
Published: November 11, 2026
Vulnerability identifier: #VU165166
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126155
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to incorrect authorization. An unauthenticated remote attacker can obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests.
Affected software
FortiMail
How to mitigate CVE-2026-126155
Install update from vendor's website.
FortiMail - addressed in versions 7.4.9, 7.6.7, 8.0.2