{"id":"CVE-2026-126156","kind":"vulnerability","aliases":["CVE-2026-126156"],"related":[],"title":"Fortinet FortiMail: unauthenticated attacker can take over IBE recipient accounts","description":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.","summary":"A flaw in Fortinet FortiMail's handling of user-controlled keys lets an unauthenticated remote attacker take over an arbitrary IBE recipient account using crafted HTTP requests. The attacker gets full control of the victim's secure-mail account without logging in.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-gateway","fortimail","ibe","infrastructure"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"- Check the FortiMail version under the admin dashboard or with the product's version output, and compare it with the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.\n- Confirm whether IBE (Identity Based Encryption) secure mail is in use on the appliance.","fix":"- FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2 (all versions): the sources do not name a fixed version; check the Fortinet advisory.","status":"open","published_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","triaged_at":"2026-11-11T22:31:10+00:00","updated_at":"2026-11-11T22:31:10+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T22:31:10Z","model":"claude-haiku-5-5","output":{"fix":"- FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2 (all versions): the sources do not name a fixed version; check the Fortinet advisory.","reach":"internet","title":"Fortinet FortiMail: unauthenticated attacker can take over IBE recipient accounts","impact":"high","summary":"A flaw in Fortinet FortiMail's handling of user-controlled keys lets an unauthenticated remote attacker take over an arbitrary IBE recipient account using crafted HTTP requests. The attacker gets full control of the victim's secure-mail account without logging in.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimail","email-gateway","ibe"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker takes over arbitrary IBE recipient accounts and reads their secure mail","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126156 to confirm fixed versions and whether IBE must be enabled.","how_to_check":"- Check the FortiMail version under the admin dashboard or with the product's version output, and compare it with the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.\n- Confirm whether IBE (Identity Based Encryption) secure mail is in use on the appliance.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"FortiMail appliances in the listed version ranges that expose IBE secure-mail features to the internet or to untrusted networks are exposed. Sites running other FortiMail versions or without IBE in use are not in the stated range; the sources do not say whether IBE must be enabled to be vulnerable.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000831,"input_tokens":4602,"output_tokens":741,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126156':13A,16A '-2026':12A,15A '7.2':90C '7.4.0':86C '7.4.8':88C '7.6.0':82C '7.6.6':84C '8.0.0':78C '8.0.1':80C 'account':10A,46B,63B,106C 'allow':94C 'arbitrari':43B,103C 'attack':4A,39B,52B,98C 'author':67C 'bypass':68C 'control':33B,55B,72C 'craft':48B,108C 'cve':11A,14A 'email':18B 'email-gateway':17B 'flaw':24B 'fortimail':2A,20B,27B,77C,81C,85C,89C 'fortinet':1A,26B,76C 'full':54B 'gateway':19B 'get':53B 'handl':29B 'http':49B,109C 'ibe':8A,21B,44B,104C 'infrastructur':22B 'key':34B,73C 'let':35B 'log':65B 'mail':62B 'may':93C 'recipi':9A,45B,105C 'remot':38B,97C 'request':50B,110C 'secur':61B 'secure-mail':60B 'take':6A,40B,100C 'unauthent':3A,37B,96C 'use':47B 'user':32B,71C 'user-control':31B,70C 'version':92C 'via':107C 'victim':58B 'vulner':74C 'without':64B","nicknames":[],"mitigations":[],"who_affected":"FortiMail appliances in the listed version ranges that expose IBE secure-mail features to the internet or to untrusted networks are exposed. Sites running other FortiMail versions or without IBE in use are not in the stated range; the sources do not say whether IBE must be enabled to be vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","emailgateway","fortimail","ibe","infrastructure"],"campaign_type":null,"search_a":"'-126156':13A,16A '-2026':12A,15A 'account':10A 'attack':4A 'cve':11A,14A 'fortimail':2A 'fortinet':1A 'ibe':8A 'recipi':9A 'take':6A 'unauthent':3A","search_b":"'account':46B,63B 'arbitrari':43B 'attack':39B,52B 'control':33B,55B 'craft':48B 'email':18B 'email-gateway':17B 'flaw':24B 'fortimail':20B,27B 'fortinet':26B 'full':54B 'gateway':19B 'get':53B 'handl':29B 'http':49B 'ibe':21B,44B 'infrastructur':22B 'key':34B 'let':35B 'log':65B 'mail':62B 'recipi':45B 'remot':38B 'request':50B 'secur':61B 'secure-mail':60B 'take':40B 'unauthent':37B 'use':47B 'user':32B 'user-control':31B 'victim':58B 'without':64B","search_c":"'7.2':90C '7.4.0':86C '7.4.8':88C '7.6.0':82C '7.6.6':84C '8.0.0':78C '8.0.1':80C 'account':106C 'allow':94C 'arbitrari':103C 'attack':98C 'author':67C 'bypass':68C 'control':72C 'craft':108C 'fortimail':77C,81C,85C,89C 'fortinet':76C 'http':109C 'ibe':104C 'key':73C 'may':93C 'recipi':105C 'remot':97C 'request':110C 'take':100C 'unauthent':96C 'user':71C 'user-control':70C 'version':92C 'via':107C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126156","severity":null,"published_at":"2026-11-11T22:17:13+00:00","modified_at":"2026-11-11T22:17:13+00:00","first_seen_at":"2026-11-11T22:29:28+00:00","fetched_at":"2026-11-11T22:29:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}