Unauthenticated FortiMail flaw can alter quarantined mail
Original title: Authorization bypass through user-controlled key
Fortinet scores the quarantine release-or-delete issue CVSS 7.5 and does not name versions or a patch.
Fortinet PSIRT describes an authorization bypass through a user-controlled key (CWE-639) in FortiMail, advisory FG-IR-26-211. An unauthenticated attacker may release or delete quarantined messages for arbitrary mailboxes using a crafted quarantine release request. The advisory was revised on November 10, 2026, without listing versions or a fix.
Unconfirmed: Affected versions, remediation, and exploitation are not stated.
- CVSSv3 score is 7.5.
- No authentication is required.
- The action is release or deletion of quarantined messages.
- The vector is a crafted quarantine release request; ID FG-IR-26-211.
Impact: Release or deletion of quarantined messages for arbitrary mailboxes
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 7. 5 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release request. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.