---
id: "CVE-2026-126155"
page: "https://infrastack.ai/live/CVE-2026-126155"
kind: "vulnerability"
aliases: ["CVE-2026-126155"]
title: "FortiMail: authorization flaw lets outsiders read and send IBE mail"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiMail", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiMail 7.6", "fixed": ["7.6.7"], "affected": ">= 7.6.0, <= 7.6.6", "ecosystem": "vendor"}, {"name": "FortiMail 7.4", "fixed": ["7.4.9"], "affected": ">= 7.4.0, <= 7.4.8", "ecosystem": "vendor"}, {"name": "FortiMail 7.2", "fixed": [], "affected": "all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["email", "fortimail", "fortinet", "ibe", "infrastructure", "self-hosted"]
not_affected_if: ["fortimail-cloud", "ibe-not-enabled"]
published_at: "2026-11-11T22:17:13+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:33:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126155", "first_seen_at": "2026-11-11T22:29:28+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-207", "first_seen_at": "2026-11-11T22:33:22+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-207"]}]
exploit_sources: []
---

# FortiMail: authorization flaw lets outsiders read and send IBE mail

Link for people: https://infrastack.ai/live/CVE-2026-126155 (this .md is for agents)

FortiMail's IBE webmail has an incorrect authorization check. An unauthenticated remote attacker can craft HTTP requests to get a logged-in IBE webmail session as any IBE recipient, then read or send that person's encrypted mail.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiMail affected >= 8.0.0, <= 8.0.1 fixed 8.0.2
- vendor:FortiMail 7.6 affected >= 7.6.0, <= 7.6.6 fixed 7.6.7
- vendor:FortiMail 7.4 affected >= 7.4.0, <= 7.4.8 fixed 7.4.9
- vendor:FortiMail 7.2 affected all versions fixed no fixed version listed

## How to check

Run 'get system status' on the appliance (or check the admin dashboard) and compare with: 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, any 7.2. Fortinet's advisory does not mention an IBE setting, so also check whether IBE webmail is enabled and reachable (our reading, not stated by Fortinet). Fortinet lists no workaround and no virtual patch (FG-IR-26-207); upgrading is the fix. FortiMail Cloud customers need do nothing. Related separate advisories: FG-IR-26-208 and FG-IR-26-202 also concern IBE recipients' accounts.

## Fix

Upgrade FortiMail 8.0 to 8.0.2+, 7.6 to 7.6.7+, 7.4 to 7.4.9+. FortiMail 7.2 has no fixed 7.2 build: migrate to a fixed release (7.4.9+ / 7.6.7+ / 8.0.2+). FortiMail Cloud was already updated on 2026-10-05; no customer action.

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126155
- 2026-11-11T22:33:22+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-207 — Fortinet PSIRT FG-IR-26-207 read: fixed versions per branch, 7.2 has no fix (migrate), no virtual patch, no workaround listed. Not exploited per vendor. Page Impact field says 'Denial of service', inconsistent with the description; ignored. IBE-enabled condition not stated by vendor, so how_to_check not verified. Social search skipped.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-207 Incorrect authorization (FortiMail) https://www.fortiguard.com/psirt/FG-IR-26-207

## From the sources

A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_