{"id":"CVE-2026-126225","kind":"vulnerability","aliases":["CVE-2026-126225"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: crafted request lets logged-in users gain privileges","description":"A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request.","summary":"A missing authorization check in Fortinet FortiAnalyzer and FortiManager lets an authenticated user raise their own privileges through a crafted JSON-RPC request. An attacker who already has a low-privilege account could gain administrative control of the management appliance.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["no-authenticated-users","outside-listed-versions"],"how_to_check":"- Check the running version of FortiAnalyzer or FortiManager against the affected ranges: `8.0.0` through `8.0.1` and `7.6.7`, including the Cloud variants.\n- Review which accounts exist on the appliance and which ones are non-administrative.","fix":"- FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1 and 7.6.7, FortiManager 8.0.0 through 8.0.1 and 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1 and 7.6.7: the sources do not name a fixed version.","status":"open","published_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:57+00:00","updated_at":"2026-11-11T22:33:57+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-11T22:33:57Z","model":"claude-haiku-5-5","output":{"fix":"- FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1 and 7.6.7, FortiManager 8.0.0 through 8.0.1 and 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1 and 7.6.7: the sources do not name a fixed version.","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: crafted request lets logged-in users gain privileges","impact":"high","summary":"A missing authorization check in Fortinet FortiAnalyzer and FortiManager lets an authenticated user raise their own privileges through a crafted JSON-RPC request. An attacker who already has a low-privilege account could gain administrative control of the management appliance.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privilege user gains administrative control of the management appliance","analyst_note":"Fixed versions and vendor advisory not in sources; check Fortinet PSIRT for the patched release and the exact affected range.","how_to_check":"- Check the running version of FortiAnalyzer or FortiManager against the affected ranges: `8.0.0` through `8.0.1` and `7.6.7`, including the Cloud variants.\n- Review which accounts exist on the appliance and which ones are non-administrative.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-authenticated-users","outside-listed-versions"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or in Fortinet's cloud, in the listed versions. Exposure requires an account on the device, so appliances where only administrators can log in carry less risk. Teams that run these only as managed Fortinet cloud services should check with the vendor.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000851,"input_tokens":4682,"output_tokens":766,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126225':16A,19A '-2026':15A,18A '7.6.7':80C,88C,94C,102C '8.0.0':76C,83C,90C,97C '8.0.1':78C,85C,92C,99C 'account':60B 'administr':63B 'allow':104C 'alreadi':54B 'applianc':68B 'attack':52B,107C 'authent':38B,106C 'author':29B,71C 'check':30B 'cloud':82C,87C,96C,101C 'control':64B 'could':61B 'craft':5A,46B,113C 'cve':14A,17A 'elev':109C 'fortianalyz':2A,20B,33B,75C,79C,81C,86C 'fortimanag':4A,21B,35B,89C,93C,95C,100C 'fortinet':1A,22B,32B,74C 'gain':12A,62B 'host':25B 'json':48B,115C 'json-rpc':47B,114C 'let':7A,36B 'log':9A 'logged-in':8A 'low':58B 'low-privileg':57B 'manag':67B 'may':103C 'miss':28B,70C 'privileg':13A,43B,59B,111C 'rais':40B 'request':6A,50B,117C 'rpc':49B,116C 'self':24B 'self-host':23B 'user':11A,39B 'vendor':26B 'via':112C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or in Fortinet's cloud, in the listed versions. Exposure requires an account on the device, so appliances where only administrators can log in carry less risk. Teams that run these only as managed Fortinet cloud services should check with the vendor.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126225':16A,19A '-2026':15A,18A 'craft':5A 'cve':14A,17A 'fortianalyz':2A 'fortimanag':4A 'fortinet':1A 'gain':12A 'let':7A 'log':9A 'logged-in':8A 'privileg':13A 'request':6A 'user':11A","search_b":"'account':60B 'administr':63B 'alreadi':54B 'applianc':68B 'attack':52B 'authent':38B 'author':29B 'check':30B 'control':64B 'could':61B 'craft':46B 'fortianalyz':20B,33B 'fortimanag':21B,35B 'fortinet':22B,32B 'gain':62B 'host':25B 'json':48B 'json-rpc':47B 'let':36B 'low':58B 'low-privileg':57B 'manag':67B 'miss':28B 'privileg':43B,59B 'rais':40B 'request':50B 'rpc':49B 'self':24B 'self-host':23B 'user':39B 'vendor':26B","search_c":"'7.6.7':80C,88C,94C,102C '8.0.0':76C,83C,90C,97C '8.0.1':78C,85C,92C,99C 'allow':104C 'attack':107C 'authent':106C 'author':71C 'cloud':82C,87C,96C,101C 'craft':113C 'elev':109C 'fortianalyz':75C,79C,81C,86C 'fortimanag':89C,93C,95C,100C 'fortinet':74C 'json':115C 'json-rpc':114C 'may':103C 'miss':70C 'privileg':111C 'request':117C 'rpc':116C 'via':112C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126225","severity":null,"published_at":"2026-11-11T22:17:20+00:00","modified_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}