NewsFortinet PSIRT10.11.2026

Incorrect authorization

Teaser from the source

CVSSv3 Score: 9.1 An Incorrect Authorization vulnerability [CWE-863] in FortiAuthenticator may allow an attacker to bypass authentication and gain unauthorized access. Revised on 2026-11-10 00:00:00

This is the RSS-feed teaser. Read the full article at the original source.

Read at Fortinet PSIRT

Other advisories

MediumCVE-2026-129428Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users…
HighCVE-2026-129429Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime meth…
Not ratedCVE-2026-105984The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthen…
Not ratedCVE-2026-116528The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its s…
Not ratedCVE-2026-105983The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions and REST routes, a…
Not ratedCVE-2026-111033The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post sav…
CriticalCVE-2026-126173The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the…
Not ratedosv:CVE-2026-71531PrestaShop Webservice API Authorization Bypass via id_shop Parameter

Other news entries

Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-265

More on authorization

Other advisories

Other news entries