An improper access control flaw in Fortinet FortiSandbox and its cloud and PaaS offerings could let an unauthenticated or partially authenticated attacker read protected data from the system. The flaw permits the attacker to construct crafted HTTP requests that bypass normal authorization checks, exposing sensitive information. The weakness corresponds to CWE‑284, which indicates that the software fails to adequately enforce access control rules.

The vulnerability affects Fortinet FortiSandbox products from version 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8, as well as FortiSandbox Cloud versions 5.0.4 and 5.0.5 and FortiSandbox PaaS versions 5.0.4 and 5.0.5. Both on‑premise and cloud‑based deployments are impacted if they have not applied the available patches.

The CVSS base score of 8.9 indicates high severity. The EPSS score is unavailable, so the likelihood of exploitation is not quantified, but the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote via crafted HTTP requests sent to exposed endpoints, which means an attacker can trigger the flaw from outside the network without needing privileged credentials. Because the flaw involves insufficient authorization checks, it does not require local access or additional privileges, making the attack path relatively simple.