{"id":"CVE-2026-126152","kind":"vulnerability","aliases":["CVE-2026-126152"],"related":[],"title":"FortiMail: authenticated users can delete directories and read other users' mail","description":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces.","summary":"Fortinet FortiMail has an authorization bypass that lets a logged-in remote attacker delete arbitrary directories as root. The same flaw can expose or delete other users' calendar and mailbox data across tenant domains through crafted HTTP requests to the webmail and admin interfaces.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-gateway","fortimail","multi-tenant","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed FortiMail version in the admin interface and compare it with the affected ranges.","fix":"- Affected: `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions.\n- Fixed versions: unknown; the sources do not say.","status":"open","published_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:31:54+00:00","updated_at":"2026-11-11T22:31:54+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-11T22:31:54Z","model":"claude-haiku-5-5","output":{"fix":"- Affected: `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions.\n- Fixed versions: unknown; the sources do not say.","reach":"internet","title":"FortiMail: authenticated users can delete directories and read other users' mail","impact":"high","summary":"Fortinet FortiMail has an authorization bypass that lets a logged-in remote attacker delete arbitrary directories as root. The same flaw can expose or delete other users' calendar and mailbox data across tenant domains through crafted HTTP requests to the webmail and admin interfaces.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimail","email-gateway","multi-tenant"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Root-level directory deletion and cross-tenant mailbox access","analyst_note":"Check Fortinet's PSIRT advisory for fixed versions and the exact interface exposure; the NVD entry alone gives no fix.","how_to_check":"- Check the installed FortiMail version in the admin interface and compare it with the affected ranges.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, or any 7.2 release. The attacker needs a valid authenticated account, and the flaw is reachable through the webmail and administrative interfaces. Multi-tenant deployments are the ones where cross-domain mailbox access matters most. unknown whether the flaw is reachable by default configuration.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000811,"input_tokens":4634,"output_tokens":695,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126152':14A,17A '-2026':13A,16A '7.2':95C '7.4.0':91C '7.4.8':93C '7.6.0':87C '7.6.6':89C '8.0.0':83C '8.0.1':85C 'access':112C 'across':58B,121C 'admin':69B 'administr':132C 'allow':99C 'arbitrari':41B,106C 'attack':39B,103C 'authent':2A,101C 'author':30B,72C 'bypass':31B,73C 'calendar':54B,117C 'control':77C 'craft':62B,125C 'cve':12A,15A 'data':57B,120C 'delet':5A,40B,51B,105C,114C 'directori':6A,42B,107C 'domain':60B,123C 'email':19B 'email-gateway':18B 'expos':49B 'flaw':47B 'fortimail':1A,21B,27B,82C,86C,90C,94C 'fortinet':26B,81C 'gateway':20B 'http':63B,126C 'interfac':70B,133C 'key':78C 'let':33B 'log':36B 'logged-in':35B 'mail':11A 'mailbox':56B,119C 'may':98C 'multi':23B 'multi-ten':22B 'read':8A 'remot':38B,102C 'request':64B,127C 'root':44B,109C 'tenant':24B,59B,122C 'user':3A,10A,53B,76C,116C 'user-control':75C 'vendor':25B 'version':97C 'via':124C 'vulner':79C 'webmail':67B,130C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, or any 7.2 release. The attacker needs a valid authenticated account, and the flaw is reachable through the webmail and administrative interfaces. Multi-tenant deployments are the ones where cross-domain mailbox access matters most. unknown whether the flaw is reachable by default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailgateway","fortimail","high","multitenant","vendor"],"campaign_type":null,"search_a":"'-126152':14A,17A '-2026':13A,16A 'authent':2A 'cve':12A,15A 'delet':5A 'directori':6A 'fortimail':1A 'mail':11A 'read':8A 'user':3A,10A","search_b":"'across':58B 'admin':69B 'arbitrari':41B 'attack':39B 'author':30B 'bypass':31B 'calendar':54B 'craft':62B 'data':57B 'delet':40B,51B 'directori':42B 'domain':60B 'email':19B 'email-gateway':18B 'expos':49B 'flaw':47B 'fortimail':21B,27B 'fortinet':26B 'gateway':20B 'http':63B 'interfac':70B 'let':33B 'log':36B 'logged-in':35B 'mailbox':56B 'multi':23B 'multi-ten':22B 'remot':38B 'request':64B 'root':44B 'tenant':24B,59B 'user':53B 'vendor':25B 'webmail':67B","search_c":"'7.2':95C '7.4.0':91C '7.4.8':93C '7.6.0':87C '7.6.6':89C '8.0.0':83C '8.0.1':85C 'access':112C 'across':121C 'administr':132C 'allow':99C 'arbitrari':106C 'attack':103C 'authent':101C 'author':72C 'bypass':73C 'calendar':117C 'control':77C 'craft':125C 'data':120C 'delet':105C,114C 'directori':107C 'domain':123C 'fortimail':82C,86C,90C,94C 'fortinet':81C 'http':126C 'interfac':133C 'key':78C 'mailbox':119C 'may':98C 'remot':102C 'request':127C 'root':109C 'tenant':122C 'user':76C,116C 'user-control':75C 'version':97C 'via':124C 'vulner':79C 'webmail':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126152","severity":null,"published_at":"2026-11-11T22:17:12+00:00","modified_at":"2026-11-11T22:17:12+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}