---
id: "CVE-2026-126159"
page: "https://infrastack.ai/live/CVE-2026-126159"
kind: "vulnerability"
aliases: ["CVE-2026-126159"]
title: "Fortinet FortiMail: unauthenticated attacker can release or delete other users' quarantined mail"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["email-gateway", "fortimail", "fortinet", "infrastructure"]
not_affected_if: ["version-outside-range"]
published_at: "2026-11-11T22:17:13+00:00"
first_seen_at: "2026-11-11T22:29:28+00:00"
updated_at: "2026-11-11T22:33:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126159", "first_seen_at": "2026-11-11T22:29:28+00:00"}]
exploit_sources: []
---

# Fortinet FortiMail: unauthenticated attacker can release or delete other users' quarantined mail

Link for people: https://infrastack.ai/live/CVE-2026-126159 (this .md is for agents)

FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all of 7.2 let an unauthenticated attacker send a crafted quarantine release request. The attacker can release or delete quarantined messages belonging to arbitrary mailboxes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FortiMail firmware version in the admin GUI or with `get system status` on the CLI, and compare it with the affected ranges.
- Confirm whether the quarantine release interface is reachable from the internet.

## Fix

- FortiMail 8.0.0 through 8.0.1: unknown
- FortiMail 7.6.0 through 7.6.6: unknown
- FortiMail 7.4.0 through 7.4.8: unknown
- FortiMail 7.2 (all versions): unknown

## Timeline

- 2026-11-11T22:29:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126159

## From the sources

A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_