FG-IR-26-244: Authorization bypass through user-controlled key in dmserver
Published Nov 10, 2026
·Updated
An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests.
Affected Software
16 affected componentsFixes available
Fortinet FortiAnalyzer>=8.0.0<=8.0.1
Fortinet FortiAnalyzer>=7.6.0<=7.6.7
Fortinet FortiAnalyzer>=7.4.0<=7.4.11
Fortinet FortiAnalyzer>=7.2
Fortinet FortiAnalyzer Cloud=.
Fortinet FortiAnalyzer Cloud>=7.6.0<=7.6.7
Fortinet FortiAnalyzer Cloud>=7.4.1<=7.4.11
Fortinet FortiAnalyzer Cloud>=7.2
Fortinet FortiManager>=8.0.0<=8.0.1
Fortinet FortiManager>=7.6.0<=7.6.7
Fortinet FortiManager>=7.4.0<=7.4.11
Fortinet FortiManager>=7.2
Fortinet FortiManager Cloud=.
Fortinet FortiManager Cloud>=7.6.0<=7.6.7
Fortinet FortiManager Cloud>=7.4.1<=7.4.11
Fortinet FortiManager Cloud>=7.2
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software