---
id: "CVE-2026-126225"
page: "https://infrastack.ai/live/CVE-2026-126225"
kind: "vulnerability"
aliases: ["CVE-2026-126225"]
title: "Fortinet FortiAnalyzer and FortiManager: crafted request lets logged-in users gain privileges"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["no-authenticated-users", "outside-listed-versions"]
published_at: "2026-11-11T22:17:20+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:33:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126225", "first_seen_at": "2026-11-11T22:29:31+00:00"}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: crafted request lets logged-in users gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-126225 (this .md is for agents)

A missing authorization check in Fortinet FortiAnalyzer and FortiManager lets an authenticated user raise their own privileges through a crafted JSON-RPC request. An attacker who already has a low-privilege account could gain administrative control of the management appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running version of FortiAnalyzer or FortiManager against the affected ranges: `8.0.0` through `8.0.1` and `7.6.7`, including the Cloud variants.
- Review which accounts exist on the appliance and which ones are non-administrative.

## Fix

- FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1 and 7.6.7, FortiManager 8.0.0 through 8.0.1 and 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1 and 7.6.7: the sources do not name a fixed version.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126225

## From the sources

A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_