---
id: "CVE-2026-126238"
page: "https://infrastack.ai/live/CVE-2026-126238"
kind: "vulnerability"
aliases: ["CVE-2026-126238"]
title: "Fortinet FortiAuthenticator: authorization bypass gives unauthenticated access to restricted functions"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4", "6.6.11"], "affected": ">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortiauthenticator", "fortinet", "rest-api", "self-hosted", "vendor"]
not_affected_if: ["fixed-version", "management-interface-not-exposed", "versions-outside-affected-ranges"]
published_at: "2026-11-11T22:17:23+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126238", "first_seen_at": "2026-11-11T22:29:32+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-253", "first_seen_at": "2026-11-11T22:38:49+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-253"]}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: authorization bypass gives unauthenticated access to restricted functions

Link for people: https://infrastack.ai/live/CVE-2026-126238 (this .md is for agents)

Fortinet FG-IR-26-253: an incorrect authorization flaw in the FortiAuthenticator REST API lets an unauthenticated attacker bypass authorization checks and reach restricted functions. CVSS 8.6. Fixed in 8.0.4 and 6.6.11; no workaround. Not known to be exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10 fixed 8.0.4, 6.6.11

## How to check

Check the FortiAuthenticator version (admin GUI dashboard, or CLI 'get system status'). Exposed if it is 8.0.0 to 8.0.3 or 6.6.0 to 6.6.10. Also check whether the web/API interface is reachable from the internet; restrict it to trusted networks until patched.

## Fix

Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above. Fortinet lists no workaround and no virtual patch.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126238
- 2026-11-11T22:38:49+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-253 — Read Fortinet PSIRT FG-IR-26-253: fixed 8.0.4 / 6.6.11, no workaround or virtual patch listed, not known exploited, no public PoC seen. Sibling FortiAuthenticator advisories same day (FG-IR-26-254, -258) same fixed versions.

## Documents

- [advisory] FG-IR-26-253 Incorrect authorization in rest-api (FortiAuthenticator) https://www.fortiguard.com/psirt/FG-IR-26-253

## From the sources

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_