FortiManager dmserver flaw lets admins access other VDOMs
Original title: Authorization bypass through user-controlled key in dmserver
The CVSS 9.1 CWE-639 issue also covers FortiAnalyzer and both cloud products; no fix or exploitation is stated.
Fortinet revised FG-IR-26-244 on November 10. An authorization bypass through a user-controlled key in the dmserver component of FortiManager, FortiAnalyzer, FortiManager Cloud, and FortiAnalyzer Cloud could let an authenticated administrator reach other VDOMs through crafted HTTP requests. Fortinet scores it CVSSv3 9.1. Versions, fixes, and exploitation are not given.
Unconfirmed: No affected versions, fixed versions, or exploitation status are stated.
- CVSSv3 score is 9.1; weakness is CWE-639.
- The attacker must be an authenticated administrator.
- Access is to other VDOMs, via crafted HTTP requests.
- Advisory revised on November 10, 2026.
Impact: Authenticated administrator access to other VDOMs
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 9. 1 An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.