CVE-2026-126152: High severity vulnerability
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.4.9 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
FortiMailto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to send crafted HTTP requests to FortiMail webmail or administrative interfaces. The issue is remotely exploitable and does not require user interaction.
Which deployments are affected?
Affected versions are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all FortiMail 7.2 versions. The available information does not state whether a default configuration is affected.
What could an attacker do after exploitation?
An authenticated attacker may delete arbitrary directories with root privileges. They may also access or delete calendar and mailbox data belonging to users in other tenant domains.
How can organizations determine whether they may be affected?
Identify the FortiMail version in use and determine whether webmail or administrative HTTP interfaces are reachable by authenticated users. Systems running one of the listed version ranges should be treated as affected based on the available information.