FORTIMAIL · CVE-2026-126150 · Vendor
FIX → 8.0.1 · 7.6.6 +2 ✓ verified
FortiMail's password recovery for IBE webmail users can be abused with specially crafted HTTP requests to reset any user's password. An unauthenticated attacker who does this can take over the victim's account and read their encrypted mail.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running FortiMail appliances in the affected version ranges that offer IBE webmail to recipients. The flaw is reachable over HTTP without an account, so any FortiMail with IBE webmail exposed to the internet is in scope. Installations outside the listed ranges are not named by the source.
Not affected if fortimail-cloud, ibe-webmail-disabled, version-outside-listed-ranges
Who cares email-gateway, fortimail, ibe-webmail, self-hosted
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.1 · 7.6.6 +2
8.0.0 to 8.0.1+; 7.6.0-7.6.5 to 7.6.6+; 7.4.0-7.4.7 to 7.4.8+; 7.2.0-7.2.9 to upcoming 7.2.10 (not yet released per advisory)