NewsFortinet PSIRT
Improper access control on API endpoints
Teaser from the source
CVSSv3 Score: 9.8 An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. Revised on 2026-05-12 00:00:00
This is the RSS-feed teaser. Read the full article at the original source.
Read at Fortinet PSIRTMore on endpoints
Other advisories
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- LowCVE-2026-115364OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints
- Not ratedosv:CVE-2026-61571AVideo-Encoder: missing authentication on control and status endpoints
- MediumCVE-2026-77061boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system log…
- MediumCVE-2026-77058boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin…
- Not ratedosv:CVE-2026-116485danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
Other news entries
- GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHubNewsDark Reading
- Fabric API Authentication bypassNewsFortinet PSIRT
- NCSC-2026-0412 [1.00] [M/H] Kwetsbaarheden verholpen in Splunk EnterpriseNewsNCSC-NL
- Cisco License (Smart Software Manager) On-Prem VulnerabilitiesNewsCisco PSIRT
- Reducing shadow IT visibility gaps with WazuhNewsBleepingComputer
- NCSC-2026-0340 [1.00] [M/H] Kwetsbaarheden verholpen in Aruba Networks ArubaOS-CXNewsNCSC-NL
- Securing Claude Code: The New Compliance API, Local Visibility, and Identity GovernanceNewsThe Hacker News
- AI Speeds Up Malware Development, Not Its Success Rate: AnalysisNewsSecurityWeek
Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-128
ID