FortiAnalyzer and FortiManager allow privilege elevation via JSON-RPC
Original title: Improper privilege management
An already privileged authenticated attacker can raise privileges with a crafted JSON-RPC request.
Fortinet says an improper privilege management flaw affects FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud. An authenticated privileged attacker may elevate privileges through a crafted JSON-RPC request. The score is CVSS 7.2, and the advisory was revised on November 10.
Unconfirmed: Affected versions, a fix, a CVE, and exploitation status are not stated.
- Fortinet maps the issue to CWE-269.
- Cloud editions of both products are included.
- The attacker must already hold privileged access.
- No fixed version is stated in the snippet.
Impact: privileged attacker can elevate privileges via JSON-RPC
| Product | Affected |
|---|---|
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 An improper privilege management vulnerability [CWE-269] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated privileged attacker to elevate their privileges via crafted JSON-RPC request. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.