CVE-2026-126152 · Vendor
NO FIX YET · SEE WHAT TO DO
Fortinet FortiMail has an authorization bypass that lets a logged-in remote attacker delete arbitrary directories as root. The same flaw can expose or delete other users' calendar and mailbox data across tenant domains through crafted HTTP requests to the webmail and admin interfaces.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, or any 7.2 release. The attacker needs a valid authenticated account, and the flaw is reachable through the webmail and administrative interfaces. Multi-tenant deployments are the ones where cross-domain mailbox access matters most. unknown whether the flaw is reachable by default configuration.
Not affected if unaffected-version
Who cares email-gateway, fortimail, multi-tenant
8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.