Broken authorization
Fortinet reports a low-severity FortiSIEM authorization flaw that authenticated attackers can abuse.
Fortinet PSIRT advisory FG-IR-26-183 describes a missing-authorization flaw in the FortiSIEM GUI, scored CVSS 3.4 and classified as CWE-862. An authenticated attacker may execute unauthorized code or commands by sending specially crafted HTTP requests. The advisory was revised on 2026-10-13 and does not list a CVE identifier or report observed exploitation.
- FortiSIEM GUI issue is scored CVSS 3.4.
- CWE-862 missing authorization affects authenticated users.
- Crafted HTTP requests may run unauthorized code or commands.
- Advisory FG-IR-26-183; no CVE or exploitation stated.
CVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00
This source does not provide full text. Read it at fortiguard.fortinet.com.