Skip to content
NewA calmer, faster ZeroHour
Advisorymedium

Workflow session email approval process bypass

Fortinet PSIRT ()1
Read at fortiguard.fortinet.com
AI summary · glm-5.3Summaries by Vani AI

Fortinet disclosed an improper access control flaw (CVSS 4.7) in FortiManager allowing administrators to bypass workflow session email approval via crafted HTTP requests.

Fortinet advisory FG-IR-26-171 covers an improper access control vulnerability (CWE-284) in FortiManager, rated CVSSv3 4.7. An administrator can bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests. The advisory was revised on 2026-09-08.

Key facts
  • CVSSv3 4.7 improper access control (CWE-284) in FortiManager
  • Administrator can bypass workflow session approval process
  • Exploited via crafted HTTP or HTTPS requests
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
access-controlapproval-bypassfortimanagerfortinetpsirt

From the original article

CVSSv3 Score: 4. 7 An improper access control vulnerability [CWE-284] in FortiManager may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests. Revised on 2026-09-08 00:00:00

Fortinet PSIRT

fortiguard.fortinet.com

Read the full article at Fortinet PSIRT

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.