The vulnerability is an improper access control flaw in Fortinet FortiPortal versions 7.0, 7.2, and 7.4 that allows an attacker to gain unauthorized access to privileged functions or data, potentially compromising confidentiality and integrity. The weakness is identified as CWE‑284. The scenario may lead to an attacker manipulating portal settings, viewing sensitive information, or performing actions reserved for authenticated administrators.

Affected systems include all FortiPortal installations running the earlier releases: 7.0.0 through 7.0.14, 7.2.0 through 7.2.8, and 7.4.0 through 7.4.7. If an environment uses any of these versions, the vulnerability is present. The most recent fixed releases are 7.4.8 and 7.2.9, which contain the necessary remediation.

The CVSS score of 6.2 places this vulnerability in the medium severity range, and its EPSS score is currently not available, so the immediate exploitation risk is uncertain but the lack of KEV listing reduces the expectation of widespread attacks. Attackers would need network or web access to the FortiPortal instance; based on the description, the likely vector is via the administrative interface or underlying web services.