FG-IR-26-235: Authorization bypass through user-controlled key

Q: Who can exploit this issue?

Exploitation requires remote access to FortiManager and an authenticated account that already has admin permission. No user interaction is required.

Q: What level of access can an attacker obtain?

An attacker who successfully sends crafted HTTP requests may elevate their privileges to root. The impact includes high integrity impact, with low confidentiality and availability impact.

Q: Is public or unauthenticated access sufficient for exploitation?

No. The supplied information states that the attacker must be authenticated and have admin permission, even though the attack vector is network-based.

Published Nov 10, 2026

Updated

An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiManager may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests.

Affected Software

3 affected componentsFixes available

Fortinet FortiManager>=8.0.0<=8.0.1

Fortinet FortiManager>=7.6.0<=7.6.7

Fortinet FortiManager>=7.4.0<=7.4.11

Event History

Nov 10, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires remote access to FortiManager and an authenticated account that already has admin permission. No user interaction is required.

What level of access can an attacker obtain?

An attacker who successfully sends crafted HTTP requests may elevate their privileges to root. The impact includes high integrity impact, with low confidentiality and availability impact.

Is public or unauthenticated access sufficient for exploitation?

No. The supplied information states that the attacker must be authenticated and have admin permission, even though the attack vector is network-based.

FG-IR-26-235: Authorization bypass through user-controlled key

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access can an attacker obtain?

Is public or unauthenticated access sufficient for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access can an attacker obtain?

Is public or unauthenticated access sufficient for exploitation?