---
id: "CVE-2026-126152"
page: "https://infrastack.ai/live/CVE-2026-126152"
kind: "vulnerability"
aliases: ["CVE-2026-126152"]
title: "FortiMail: authenticated users can delete directories and read other users' mail"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["email-gateway", "fortimail", "multi-tenant", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-11T22:17:12+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:31:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126152", "first_seen_at": "2026-11-11T22:29:28+00:00"}]
exploit_sources: []
---

# FortiMail: authenticated users can delete directories and read other users' mail

Link for people: https://infrastack.ai/live/CVE-2026-126152 (this .md is for agents)

Fortinet FortiMail has an authorization bypass that lets a logged-in remote attacker delete arbitrary directories as root. The same flaw can expose or delete other users' calendar and mailbox data across tenant domains through crafted HTTP requests to the webmail and admin interfaces.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FortiMail version in the admin interface and compare it with the affected ranges.

## Fix

- Affected: `8.0.0` through `8.0.1`, `7.6.0` through `7.6.6`, `7.4.0` through `7.4.8`, and all `7.2` versions.
- Fixed versions: unknown; the sources do not say.

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126152

## From the sources

A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_