{"id":"CVE-2026-126183","kind":"vulnerability","aliases":["CVE-2026-126183"],"related":[],"title":"Fortinet FortiManager: authenticated users can run commands outside their scope","description":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the expected scope via specially crafted HTTP request.","summary":"A crafted HTTP request to FortiManager lets a logged-in user bypass authorization and execute commands outside their expected scope. The sources describe the attacker as authenticated, so the risk is mainly to accounts that already have some access.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["auth-required","version-outside-range"],"how_to_check":"- Check the FortiManager version (for example in the GUI or with `get system status`) and compare it with the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and the FortiManager Cloud equivalents.\n- Review which accounts have login access to FortiManager.","fix":"- Upgrade to a fixed release listed in the Fortinet advisory: unknown from the sources given.","status":"open","published_at":"2026-11-11T22:17:17+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:31:26+00:00","updated_at":"2026-11-11T22:31:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:31:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a fixed release listed in the Fortinet advisory: unknown from the sources given.","reach":"network","title":"Fortinet FortiManager: authenticated users can run commands outside their scope","impact":"high","summary":"A crafted HTTP request to FortiManager lets a logged-in user bypass authorization and execute commands outside their expected scope. The sources describe the attacker as authenticated, so the risk is mainly to accounts that already have some access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user executes commands beyond their permitted scope","analyst_note":"Check the Fortinet PSIRT advisory for CVE-2026-126183 for the fixed versions and any workaround.","how_to_check":"- Check the FortiManager version (for example in the GUI or with `get system status`) and compare it with the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and the FortiManager Cloud equivalents.\n- Review which accounts have login access to FortiManager.","plain_action":"","product_name":"FortiManager","needs_analyst":true,"not_affected_if":["version-outside-range","auth-required"],"who_is_affected":"FortiManager and FortiManager Cloud deployments in the listed version ranges are exposed. The attacker needs an authenticated account, so exposure depends on who can log in. Teams on versions outside the listed ranges can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000789,"input_tokens":4690,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126183':13A,16A '-2026':12A,15A '7.2.0':88C '7.2.1':106C '7.2.12':90C,108C '7.4.0':84C '7.4.1':101C '7.4.11':86C,103C '7.6.0':80C,96C '7.6.7':82C,98C '8.0.0':76C '8.0.1':78C,93C 'access':63B 'account':58B 'allow':110C 'alreadi':60B 'attack':49B,113C 'authent':3A,51B,112C 'author':37B,65C 'bypass':36B,66C 'cloud':92C,95C,100C,105C 'command':7A,40B,116C 'control':70C 'craft':25B,124C 'cve':11A,14A 'describ':47B 'execut':39B,115C 'expect':43B,120C 'fortimanag':2A,18B,29B,75C,79C,83C,87C,91C,94C,99C,104C 'fortimanager':17A 'fortinet':1A,19B,74C 'host':23B 'http':26B,125C 'infrastructur':20B 'key':71C 'let':30B 'log':33B 'logged-in':32B 'main':56B 'may':109C 'outsid':8A,41B,117C 'request':27B,126C 'risk':54B 'run':6A 'scope':10A,44B,121C 'self':22B 'self-host':21B 'sourc':46B 'special':123C 'user':4A,35B,69C 'user-control':68C 'via':122C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"FortiManager and FortiManager Cloud deployments in the listed version ranges are exposed. The attacker needs an authenticated account, so exposure depends on who can log in. Teams on versions outside the listed ranges can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["fortimanager"],"ptokens":["fortimanager"],"labels":["fortimanager","fortinet","high","infrastructure","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126183':13A,16A '-2026':12A,15A 'authent':3A 'command':7A 'cve':11A,14A 'fortimanag':2A 'fortimanager':17A 'fortinet':1A 'outsid':8A 'run':6A 'scope':10A 'user':4A","search_b":"'access':63B 'account':58B 'alreadi':60B 'attack':49B 'authent':51B 'author':37B 'bypass':36B 'command':40B 'craft':25B 'describ':47B 'execut':39B 'expect':43B 'fortimanag':18B,29B 'fortinet':19B 'host':23B 'http':26B 'infrastructur':20B 'let':30B 'log':33B 'logged-in':32B 'main':56B 'outsid':41B 'request':27B 'risk':54B 'scope':44B 'self':22B 'self-host':21B 'sourc':46B 'user':35B","search_c":"'7.2.0':88C '7.2.1':106C '7.2.12':90C,108C '7.4.0':84C '7.4.1':101C '7.4.11':86C,103C '7.6.0':80C,96C '7.6.7':82C,98C '8.0.0':76C '8.0.1':78C,93C 'allow':110C 'attack':113C 'authent':112C 'author':65C 'bypass':66C 'cloud':92C,95C,100C,105C 'command':116C 'control':70C 'craft':124C 'execut':115C 'expect':120C 'fortimanag':75C,79C,83C,87C,91C,94C,99C,104C 'fortinet':74C 'http':125C 'key':71C 'may':109C 'outsid':117C 'request':126C 'scope':121C 'special':123C 'user':69C 'user-control':68C 'via':122C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126183","severity":null,"published_at":"2026-11-11T22:17:17+00:00","modified_at":"2026-11-11T22:17:17+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}