FortiMail flaw lets unauthenticated attackers access IBE webmail
Original title: Incorrect authorization
Attackers can obtain any IBE recipient session and read or send that user's encrypted mail.
Fortinet reports an incorrect authorization vulnerability in FortiMail scored CVSS 9.1. An unauthenticated remote attacker may obtain an authenticated IBE webmail session as any IBE recipient through crafted HTTP requests. The attacker can then read or send that recipient's encrypted mail. The advisory was revised on November 10.
Unconfirmed: Affected versions, a fix, a CVE, and exploitation status are not stated.
- Fortinet classifies the issue as CWE-863.
- No authentication is required, according to the advisory.
- Access applies to IBE webmail sessions.
- The CVSSv3 score is 9.1.
Impact: unauthenticated attacker can read or send encrypted IBE mail
| Product | Affected |
|---|---|
| Fortinet FortiMail | — |
From the original article
CVSSv3 Score: 9. 1 An Incorrect Authorization vulnerability [CWE-863] in FortiMail may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.