An improper authorization flaw in Fireware OS's Access Portal reverse proxy lets an authenticated low‑privileged user reach web applications they should not be able to access. By crafting a request for a resource they have permission for, the attacker can redirect the reverse proxy to deliver content from another protected application. The resulting data exposure and access violate proper authorization controls, corresponding to CWE‑285.

The vulnerability affects WatchGuard Fireware OS devices running any of the reported firmware versions, including 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21. Any device with the Access Portal reverse proxy enabled on these firmware levels is potentially exposed.

The CVSS score of 5.3 indicates moderate severity, and the absence of an EPSS score means the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation can be achieved by a low‑privileged authenticated user via a specially crafted HTTP request to the reverse proxy, which does not require elevated privileges or additional system access beyond legitimate credentials.