---
id: "CVE-2026-126156"
page: "https://infrastack.ai/live/CVE-2026-126156"
kind: "vulnerability"
aliases: ["CVE-2026-126156"]
title: "Fortinet FortiMail: unauthenticated attacker can take over IBE recipient accounts"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["email-gateway", "fortimail", "ibe", "infrastructure"]
not_affected_if: ["version-outside-listed-ranges"]
published_at: "2026-11-11T22:17:13+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:31:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126156", "first_seen_at": "2026-11-11T22:29:28+00:00"}]
exploit_sources: []
---

# Fortinet FortiMail: unauthenticated attacker can take over IBE recipient accounts

Link for people: https://infrastack.ai/live/CVE-2026-126156 (this .md is for agents)

A flaw in Fortinet FortiMail's handling of user-controlled keys lets an unauthenticated remote attacker take over an arbitrary IBE recipient account using crafted HTTP requests. The attacker gets full control of the victim's secure-mail account without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FortiMail version under the admin dashboard or with the product's version output, and compare it with the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all 7.2 versions.
- Confirm whether IBE (Identity Based Encryption) secure mail is in use on the appliance.

## Fix

- FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2 (all versions): the sources do not name a fixed version; check the Fortinet advisory.

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126156

## From the sources

A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_