{"id":"CVE-2026-126155","kind":"vulnerability","aliases":["CVE-2026-126155"],"related":[],"title":"FortiMail: authorization flaw lets outsiders read and send IBE mail","description":"A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests.","summary":"FortiMail's IBE webmail has an incorrect authorization check. An unauthenticated remote attacker can craft HTTP requests to get a logged-in IBE webmail session as any IBE recipient, then read or send that person's encrypted mail.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiMail","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiMail 7.6","fixed":["7.6.7"],"affected":">= 7.6.0, <= 7.6.6","ecosystem":"vendor"},{"name":"FortiMail 7.4","fixed":["7.4.9"],"affected":">= 7.4.0, <= 7.4.8","ecosystem":"vendor"},{"name":"FortiMail 7.2","fixed":[],"affected":"all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["email","fortimail","fortinet","ibe","infrastructure","self-hosted"],"not_affected_if":["fortimail-cloud","ibe-not-enabled"],"how_to_check":"Run 'get system status' on the appliance (or check the admin dashboard) and compare with: 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, any 7.2. Fortinet's advisory does not mention an IBE setting, so also check whether IBE webmail is enabled and reachable (our reading, not stated by Fortinet). Fortinet lists no workaround and no virtual patch (FG-IR-26-207); upgrading is the fix. FortiMail Cloud customers need do nothing. Related separate advisories: FG-IR-26-208 and FG-IR-26-202 also concern IBE recipients' accounts.","fix":"Upgrade FortiMail 8.0 to 8.0.2+, 7.6 to 7.6.7+, 7.4 to 7.4.9+. FortiMail 7.2 has no fixed 7.2 build: migrate to a fixed release (7.4.9+ / 7.6.7+ / 8.0.2+). FortiMail Cloud was already updated on 2026-10-05; no customer action.","status":"open","published_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:31:10+00:00","updated_at":"2026-11-11T22:33:22+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:31:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FortiMail: authorization flaw lets outsiders read and send IBE mail","impact":"high","summary":"FortiMail's IBE webmail has an incorrect authorization check. An unauthenticated remote attacker can craft HTTP requests to get a logged-in IBE webmail session as any IBE recipient, then read or send that person's encrypted mail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","fortinet","email","ibe"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads and sends encrypted mail as any IBE recipient","analyst_note":"Find Fortinet's PSIRT advisory and confirm fixed versions for each branch and any workaround for IBE, since the sources give none.","how_to_check":"- Check the FortiMail version under the admin dashboard or `get system status` on the appliance, and compare it to the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.\n- Confirm whether IBE (Identity Based Encryption) webmail is enabled on the appliance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["ibe-not-enabled"],"who_is_affected":"Organizations that run Fortinet FortiMail in the listed version ranges with IBE secure webmail enabled and reachable from the internet. The sources do not state a fixed version or a setting that closes the flaw, so teams should not assume they are safe on any version in those ranges. Sites on other FortiMail releases or without IBE in use are not described as affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000791,"input_tokens":4629,"output_tokens":656,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Fortinet's PSIRT advisory and confirm fixed versions for each branch and any workaround for IBE, since the sources give none.","search":"'-126155':13A,16A '-2026':12A,15A '7.2':23A,90C '7.4':21A '7.4.0':86C '7.4.8':88C '7.6':19A '7.6.0':82C '7.6.6':84C '8.0.0':78C '8.0.1':80C 'allow':94C 'attack':44B,98C 'authent':102C 'author':2A,39B,73C 'check':40B 'craft':46B,118C 'cve':11A,14A 'email':24B 'encrypt':69B,115C 'flaw':3A 'fortimail':1A,17A,18A,20A,22A,25B,32B,77C,81C,85C,89C 'fortinet':26B,76C 'get':50B 'host':31B 'http':47B,119C 'ibe':9A,27B,34B,55B,60B,103C,108C 'incorrect':38B,72C 'infrastructur':28B 'let':4A 'log':53B 'logged-in':52B 'mail':10A,70B,116C 'may':93C 'obtain':100C 'outsid':5A 'person':67B 'read':6A,63B,111C 'recipi':61B,109C 'remot':43B,97C 'request':48B,120C 'self':30B 'self-host':29B 'send':8A,65B,113C 'session':57B,105C 'unauthent':42B,96C 'version':92C 'via':117C 'vulner':74C 'webmail':35B,56B,104C","nicknames":[],"mitigations":[],"who_affected":"Self-managed FortiMail appliances or VMs on 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 or any 7.2, with the IBE webmail interface in use and reachable. Fortinet says FortiMail Cloud was already updated on 2026-10-05, so those customers can skip it. Fortinet lists no workaround, so exposed sites should upgrade.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:33:22Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-207","run_id":3607},"products":{"at":"2026-11-11T22:33:22Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-207","run_id":3607},"who_affected":{"at":"2026-11-11T22:33:22Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-207","run_id":3607}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["72","74","76","fortimail","fortimail72","fortimail74","fortimail76"],"ptokens":["fortimail"],"labels":["critical","email","fortimail","fortinet","ibe","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126155':13A,16A '-2026':12A,15A '7.2':23A '7.4':21A '7.6':19A 'author':2A 'cve':11A,14A 'flaw':3A 'fortimail':1A,17A,18A,20A,22A 'ibe':9A 'let':4A 'mail':10A 'outsid':5A 'read':6A 'send':8A","search_b":"'attack':44B 'author':39B 'check':40B 'craft':46B 'email':24B 'encrypt':69B 'fortimail':25B,32B 'fortinet':26B 'get':50B 'host':31B 'http':47B 'ibe':27B,34B,55B,60B 'incorrect':38B 'infrastructur':28B 'log':53B 'logged-in':52B 'mail':70B 'person':67B 'read':63B 'recipi':61B 'remot':43B 'request':48B 'self':30B 'self-host':29B 'send':65B 'session':57B 'unauthent':42B 'webmail':35B,56B","search_c":"'7.2':90C '7.4.0':86C '7.4.8':88C '7.6.0':82C '7.6.6':84C '8.0.0':78C '8.0.1':80C 'allow':94C 'attack':98C 'authent':102C 'author':73C 'craft':118C 'encrypt':115C 'fortimail':77C,81C,85C,89C 'fortinet':76C 'http':119C 'ibe':103C,108C 'incorrect':72C 'mail':116C 'may':93C 'obtain':100C 'read':111C 'recipi':109C 'remot':97C 'request':120C 'send':113C 'session':105C 'unauthent':96C 'version':92C 'via':117C 'vulner':74C 'webmail':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126155","severity":null,"published_at":"2026-11-11T22:17:13+00:00","modified_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126155:3607","url":"https://www.fortiguard.com/psirt/FG-IR-26-207","severity":null,"published_at":"2026-11-11T22:33:22+00:00","modified_at":"2026-11-11T22:33:22+00:00","first_seen_at":"2026-11-11T22:33:22+00:00","fetched_at":"2026-11-11T22:33:22+00:00","note":"Fortinet PSIRT FG-IR-26-207 read: fixed versions per branch, 7.2 has no fix (migrate), no virtual patch, no workaround listed. Not exploited per vendor. Page Impact field says 'Denial of service', inconsistent with the description; ignored. IBE-enabled condition not stated by vendor, so how_to_check not verified. Social search skipped.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-207"]}],"documents":[{"id":129646,"url":"https://www.fortiguard.com/psirt/FG-IR-26-207","title":"Fortinet PSIRT FG-IR-26-207 Incorrect authorization (FortiMail)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}