30
30
30
30
45
30
30
30
30
30
30
30
30
30
30
30
30
30
Broken Access control on Websocket streams
Fortinet FortiSOAR access control flaw (CVSS 4.9) lets zero-permission authenticated attackers subscribe to and inject broadcast messages into websocket streams.
Fortinet advisory FG-IR-26-164 discloses an improper access control vulnerability (CWE-284, CVSSv3 4.9) in FortiSOAR. An authenticated attacker with zero permissions can subscribe to websocket streams and topics and inject broadcast messages via crafted websocket requests. The advisory was revised on 2026-09-08.
16
30
30
30
30
30
30
30
45
35
30
30
45
30
30
30
30
45
30
30
30
45