{"id":"CVE-2026-126238","kind":"vulnerability","aliases":["CVE-2026-126238"],"related":[],"title":"Fortinet FortiAuthenticator: authorization bypass gives unauthenticated access to restricted functions","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality.","summary":"Fortinet FG-IR-26-253: an incorrect authorization flaw in the FortiAuthenticator REST API lets an unauthenticated attacker bypass authorization checks and reach restricted functions. CVSS 8.6. Fixed in 8.0.4 and 6.6.11; no workaround. Not known to be exploited.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4","6.6.11"],"affected":">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortiauthenticator","fortinet","rest-api","self-hosted","vendor"],"not_affected_if":["fixed-version","management-interface-not-exposed","versions-outside-affected-ranges"],"how_to_check":"Check the FortiAuthenticator version (admin GUI dashboard, or CLI 'get system status'). Exposed if it is 8.0.0 to 8.0.3 or 6.6.0 to 6.6.10. Also check whether the web/API interface is reachable from the internet; restrict it to trusted networks until patched.","fix":"Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above. Fortinet lists no workaround and no virtual patch.","status":"open","published_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:31:32+00:00","updated_at":"2026-11-11T22:38:49+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:31:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Fortinet FortiAuthenticator: authorization bypass gives unauthenticated access to restricted functions","impact":"high","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an incorrect authorization check. An unauthenticated attacker may bypass it and reach restricted functionality.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reaches restricted functionality on the authentication server","analyst_note":"Check the Fortinet PSIRT advisory for the fixed version and any workaround, and whether the flaw is reachable from the internet by default.","how_to_check":"- Confirm the installed FortiAuthenticator version in the admin interface against the affected ranges: `8.0.0` to `8.0.3` and `6.6.0` to `6.6.10`.\n- unknown for other checks: the sources do not name configuration or files to inspect.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-affected-ranges"],"who_is_affected":"Organizations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are in the affected ranges. The sources do not say which deployment settings or network exposure are needed to reach the flaw, so unknown for the rest.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4580,"output_tokens":585,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for the fixed version and any workaround, and whether the flaw is reachable from the internet by default.","search":"'-126238':13A,16A '-2026':12A,15A '-253':32B '26':31B '6.6.0':78C '6.6.10':80C '6.6.11':59B '8.0.0':74C '8.0.3':76C '8.0.4':57B '8.6':54B 'access':7A,93C 'allow':82C 'api':22B,41B 'attack':45B,85C 'author':3A,35B,47B,69C,88C 'bypass':4A,46B,87C 'check':48B,89C 'cve':11A,14A 'cvss':53B 'exploit':66B 'fg':29B 'fg-ir':28B 'fix':55B 'flaw':36B 'fortiauthent':2A,18B,39B,73C,77C 'fortiauthenticator':17A 'fortinet':1A,19B,27B,72C 'function':10A,52B,96C 'gain':91C 'give':5A 'host':25B 'incorrect':34B,68C 'ir':30B 'known':63B 'let':42B 'may':81C 'reach':50B 'rest':21B,40B 'rest-api':20B 'restrict':9A,51B,95C 'self':24B 'self-host':23B 'unauthent':6A,44B,84C 'unauthor':92C 'vendor':26B 'vulner':70C 'workaround':61B","nicknames":[],"mitigations":[],"who_affected":"Anyone running self-hosted FortiAuthenticator 8.0.0 to 8.0.3 or 6.6.0 to 6.6.10, an identity and MFA server, whose API is reachable by an attacker. Fortinet says no authentication is needed. Teams that do not run FortiAuthenticator, or already run 8.0.4 / 6.6.11 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:38:49Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-253","run_id":3626},"products":{"at":"2026-11-11T22:38:49Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-253","run_id":3626},"how_to_check":{"at":"2026-11-11T22:38:49Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-253","run_id":3626},"who_affected":{"at":"2026-11-11T22:38:49Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-253","run_id":3626}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["fortiauthenticator","fortinet","high","restapi","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126238':13A,16A '-2026':12A,15A 'access':7A 'author':3A 'bypass':4A 'cve':11A,14A 'fortiauthent':2A 'fortiauthenticator':17A 'fortinet':1A 'function':10A 'give':5A 'restrict':9A 'unauthent':6A","search_b":"'-253':32B '26':31B '6.6.11':59B '8.0.4':57B '8.6':54B 'api':22B,41B 'attack':45B 'author':35B,47B 'bypass':46B 'check':48B 'cvss':53B 'exploit':66B 'fg':29B 'fg-ir':28B 'fix':55B 'flaw':36B 'fortiauthent':18B,39B 'fortinet':19B,27B 'function':52B 'host':25B 'incorrect':34B 'ir':30B 'known':63B 'let':42B 'reach':50B 'rest':21B,40B 'rest-api':20B 'restrict':51B 'self':24B 'self-host':23B 'unauthent':44B 'vendor':26B 'workaround':61B","search_c":"'6.6.0':78C '6.6.10':80C '8.0.0':74C '8.0.3':76C 'access':93C 'allow':82C 'attack':85C 'author':69C,88C 'bypass':87C 'check':89C 'fortiauthent':73C,77C 'fortinet':72C 'function':96C 'gain':91C 'incorrect':68C 'may':81C 'restrict':95C 'unauthent':84C 'unauthor':92C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126238","severity":null,"published_at":"2026-11-11T22:17:23+00:00","modified_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126238:3626","url":"https://www.fortiguard.com/psirt/FG-IR-26-253","severity":null,"published_at":"2026-11-11T22:38:49+00:00","modified_at":"2026-11-11T22:38:49+00:00","first_seen_at":"2026-11-11T22:38:49+00:00","fetched_at":"2026-11-11T22:38:49+00:00","note":"Read Fortinet PSIRT FG-IR-26-253: fixed 8.0.4 / 6.6.11, no workaround or virtual patch listed, not known exploited, no public PoC seen. Sibling FortiAuthenticator advisories same day (FG-IR-26-254, -258) same fixed versions.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-253"]}],"documents":[{"id":129677,"url":"https://www.fortiguard.com/psirt/FG-IR-26-253","title":"FG-IR-26-253 Incorrect authorization in rest-api (FortiAuthenticator)","kind":"advisory","source":"analyst","publisher":null,"text":"Incorrect Authorization [CWE-863] in FortiAuthenticator may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality. Affected: 8.0.0 through 8.0.3 (upgrade to 8.0.4 or above); 6.6.0 through 6.6.10 (upgrade to 6.6.11 or above). Component: API (rest-api). Virtual patch: No. Known exploited: No. CVSSv3 8.6, High. Published 2026-11-10. Internally discovered by Fortinet Product Security. No workaround listed.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}