FG-IR-26-171: Workflow session email approval process bypass

Published Sep 8, 2026

Updated

An improper access control vulnerability [CWE-284] in FortiManager may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.

Affected Software

6 affected componentsFixes available

Fortinet FortiManager>=7.6.0<=7.6.4

Fortinet FortiManager>=7.4.0<=7.4.10

Fortinet FortiManager>=7.2

Fortinet FortiManager Cloud>=7.6.2<=7.6.4

Fortinet FortiManager Cloud>=7.4.1<=7.4.10

Fortinet FortiManager Cloud>=7.2

Event History

Sep 8, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access does an attacker need?

The attacker must already have administrator privileges. The attack can be performed remotely using crafted HTTP or HTTPS requests.

What is the likely security impact if exploited?

The issue is rated as having high integrity impact, with no confidentiality or availability impact indicated. An administrator could bypass the workflow-session approval process.

Which Fortinet offerings are identified as affected?

The advisory identifies Fortinet FortiManager and Fortinet FortiManager Cloud.

FG-IR-26-171: Workflow session email approval process bypass

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

What is the likely security impact if exploited?

Which Fortinet offerings are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What is the likely security impact if exploited?

Which Fortinet offerings are identified as affected?