Fortinet FortiSandbox suffers an improper access control flaw that enables an attacker to retrieve confidential data via specially crafted HTTP requests. The vulnerability, identified by CWE‑284, permits unauthenticated or minimally authenticated users to bypass normal authorization checks and read protected information, compromising data confidentiality. No exploitation of additional system resources or privileges is required; the impact is limited to the disclosure of sensitive content exposed by the server.

The flaw affects a broad range of Fortinet FortiSandbox products: on‑premise versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, and all 4.2.x releases; the corresponding Cloud releases 5.0.4 and 5.0.5; and the PaaS releases 5.0.4 and 5.0.5. Both on‑premise and cloud‑based deployments are impacted unless the available patches have been applied.

The CVSS base score of 8.9 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote via crafted HTTP requests sent to exposed endpoints, meaning an attacker can trigger the flaw from outside the network without needing privileged credentials. The weakness in authorization checks allows the attacker to read protected data without local or elevated access, making the attack path relatively simple.