FortiMail flaw lets unauthenticated attackers take over IBE accounts
Original title: Authorization bypass through user-controlled key
Fortinet rates the IBE account-takeover issue CVSS 9.1; the notice gives no versions, fix, or exploitation status.
Fortinet PSIRT describes an authorization bypass through a user-controlled key (CWE-639) in FortiMail, advisory FG-IR-26-208. An unauthenticated remote attacker may take over an arbitrary IBE recipient account by sending crafted HTTP requests. The notice was revised on November 10, 2026, and does not name affected or fixed versions.
Unconfirmed: Affected versions, a fix, and whether attackers exploit it are not stated.
- CVSSv3 score is 9.1.
- The weakness is CWE-639, authorization bypass through a user-controlled key.
- Attackers need no authentication and use crafted HTTP requests.
- The advisory ID is FG-IR-26-208, revised November 10, 2026.
Impact: Takeover of an arbitrary IBE recipient account
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 9. 1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.