CVE-2026-126225 · Vendor
NO FIX YET · SEE WHAT TO DO
A missing authorization check in Fortinet FortiAnalyzer and FortiManager lets an authenticated user raise their own privileges through a crafted JSON-RPC request. An attacker who already has a low-privilege account could gain administrative control of the management appliance.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running FortiAnalyzer or FortiManager, on-premises or in Fortinet's cloud, in the listed versions. Exposure requires an account on the device, so appliances where only administrators can log in carry less risk. Teams that run these only as managed Fortinet cloud services should check with the vendor.
Not affected if no-authenticated-users, outside-listed-versions
Who cares fortianalyzer, fortimanager, fortinet, self-hosted
8.0.0 through 8.0.1 and 7.6.7, including the Cloud variants.A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.