Incorrect authorization
CVSSv3 Score: 9.1 An Incorrect Authorization vulnerability [CWE-863] in FortiMail may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests. Revised on 2026-11-10 00:00:00
Read at Fortinet PSIRT Advisories
- Vendor
- Fortinet
- Product
- FortiMail
- CVSS v3.0
- 9.1
- Exposure class
Why it ranks 59 (High)
- CVSS v3.0 9.1 critical
- Exposed product class: email
- Widely deployed vendor product (Fortinet)
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Fortinet PSIRT Advisories (fortiguard.fortinet.com)
Related coverage
Other items that share a CVE or were clustered with this one.