Authenticated FortiMail flaw can delete directories as root
Original title: Authorization bypass through user-controlled key
The CVSS 8.1 bug also exposes or deletes other tenants' calendar and mailbox data; no fix is listed.
Fortinet PSIRT reports an authorization bypass through a user-controlled key (CWE-639) in FortiMail, FG-IR-26-204. An authenticated remote attacker may delete arbitrary directories as root, or access or delete other users' calendar and mailbox data across tenant domains. The requests target the webmail and administrative interfaces. The notice was revised on November 10, 2026.
Unconfirmed: The notice does not state affected versions, a fix, or known exploitation.
- CVSSv3 score is 8.1.
- Directory deletion runs as root.
- Impact can cross tenant domains for calendar and mailbox data.
- Interfaces named are webmail and administrative; advisory is FG-IR-26-204.
Impact: Root directory deletion and cross-tenant mailbox or calendar access
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 8. 1 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiMail may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.