A missing authorization flaw in Fortinet FortiAuthenticator allows a user with read‑only privileges to modify local user accounts by uploading a file to an unprotected endpoint. The attack can change account attributes, potentially enabling privilege escalation and compromising the device’s authentication mechanisms. This weakness corresponds to CWE‑862, which focuses on the absence of proper authorization checks.

Vendors and products impacted include Fortinet FortiAuthenticator. Versions affected are all releases from 6.3.0 through 6.6.6, as well as all 6.5 and 6.4 release lines. The advisory recommends upgrading to version 6.6.7 or later, or to 8.0.0 for more recent builds.

The CVSS v3.1 base score of 6.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an adversary who can obtain or impersonate a read‑only user account, then use the unprotected endpoint on the protected network to upload a crafted file that alters local user entries. Successful exploitation would grant the attacker the ability to create, edit, or delete user accounts.