FORTIMAIL · CVE-2026-126155 · Infrastructure
FIX → 8.0.2 · 7.6.7 · 7.4.9 ✓ verified
FortiMail's IBE webmail has an incorrect authorization check. An unauthenticated remote attacker can craft HTTP requests to get a logged-in IBE webmail session as any IBE recipient, then read or send that person's encrypted mail.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-managed FortiMail appliances or VMs on 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 or any 7.2, with the IBE webmail interface in use and reachable. Fortinet says FortiMail Cloud was already updated on 2026-10-05, so those customers can skip it. Fortinet lists no workaround, so exposed sites should upgrade.
Not affected if fortimail-cloud, ibe-not-enabled
Who cares email, fortimail, fortinet, ibe, self-hosted
get system status on the appliance (or check the admin dashboard) and compare with: 8.0.0-8.0.1, , , any 7.2A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
7.6.0-7.6.67.4.0-7.4.8Upgrade to 8.0.2 · 7.6.7 · 7.4.9