NewsFortinet PSIRT10.11.2026

Authorization bypass through user-controlled key in dmserver

CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests. Revised on 2026-11-10 00:00:00

Other advisories

MediumCVE-2026-105880Authorization Bypass Through User-Controlled Key vulnerability in Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Con…
HighCVE-2026-126429OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG reso…
HighCVE-2026-13672An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1…
Not ratedosv:CLEANSTART-2026-BG98783Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s...
CriticalCVE-2026-126229A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnaly…
HighCVE-2026-126218A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager…
HighCVE-2026-126183A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager…
HighCVE-2026-126159A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 th…

Other news entries

Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-244

More on user-controlled

Other advisories

Other news entries