Description
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release request.
Published: 2026-11-11
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Upgrade to FortiMail version 8.0.2 or above Upgrade to FortiMail version 7.6.7 or above Upgrade to FortiMail version 7.4.9 or above

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 21:45:00 +0000

Type Values Removed Values Added
Description A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release request.
First Time appeared Fortinet
Fortinet fortimail
Weaknesses CWE-639
CPEs cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet fortimail
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C'}

Subscriptions

Fortinet Fortimail
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2026-11-11T21:29:17.990Z

Reserved: 2026-11-10T20:03:46.218Z

Link: CVE-2026-126159

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T22:17:13.857

Modified: 2026-11-11T22:17:13.857

Link: CVE-2026-126159

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key