{"id":"CVE-2026-126249","kind":"vulnerability","aliases":["CVE-2026-126249"],"related":[],"title":"Fortinet FortiAuthenticator: authenticated users can escalate their privileges","description":"A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges.","summary":"FortiAuthenticator, Fortinet's identity and authentication appliance, has an improper privilege management flaw in versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. An attacker who already holds a valid account can raise their privileges beyond what they were granted.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4"],"affected":">= 8.0.0, <= 8.0.3","ecosystem":"vendor"},{"name":"FortiAuthenticator 6.6","fixed":["6.6.11"],"affected":">= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortiauthenticator","fortinet","infrastructure","self-hosted"],"not_affected_if":["no-fortiauthenticator-in-range"],"how_to_check":"Check the FortiAuthenticator version (GUI dashboard or CLI 'get system status'). Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. Fortinet lists no workaround or virtual patch; the affected component is the GUI and the attacker must be authenticated.","fix":"FortiAuthenticator 8.0: upgrade to 8.0.4 or above. FortiAuthenticator 6.6: upgrade to 6.6.11 or above.","status":"open","published_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:33:13+00:00","updated_at":"2026-11-11T22:36:35+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:33:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAuthenticator: authenticated users can escalate their privileges","impact":"medium","summary":"FortiAuthenticator, Fortinet's identity and authentication appliance, has an improper privilege management flaw in versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. An attacker who already holds a valid account can raise their privileges beyond what they were granted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user gains higher privileges than granted","analyst_note":"Check the Fortinet PSIRT advisory for the fixed version and whether any setting or workaround is stated.","how_to_check":"- Check the installed FortiAuthenticator version against the affected ranges (8.0.0 through 8.0.3, 6.6.0 through 6.6.10).\n- unknown for other checks: the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-fortiauthenticator-in-range"],"who_is_affected":"Organisations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10. The flaw needs an authenticated account, so exposure depends on who holds accounts on the appliance. unknown for anything beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4552,"output_tokens":561,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for the fixed version and whether any setting or workaround is stated.","search":"'-126249':11A,14A '-2026':10A,13A '6.6':17A '6.6.0':43B,75C '6.6.10':45B,77C '8.0.0':39B,71C '8.0.3':41B,73C 'account':53B 'allow':79C 'alreadi':49B 'applianc':30B 'attack':47B,82C 'authent':3A,29B,81C 'beyond':58B 'cve':9A,12A 'escal':6A,84C 'flaw':36B 'fortiauthent':2A,18B,24B,70C,74C 'fortiauthenticator':15A,16A 'fortinet':1A,19B,25B,69C 'grant':62B 'hold':50B 'host':23B 'ident':27B 'improp':33B,64C 'infrastructur':20B 'manag':35B,66C 'may':78C 'privileg':8A,34B,57B,65C,85C 'rais':55B 'self':22B 'self-host':21B 'user':4A 'valid':52B 'version':38B 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FortiAuthenticator 8.0.0-8.0.3 or 6.6.0-6.6.10. The attacker needs a valid authenticated account (CVSS requires high privileges), so risk depends on who holds accounts on the appliance and whether the GUI is reachable. Fortinet found it internally and reports no exploitation.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:36:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263","run_id":3619},"products":{"at":"2026-11-11T22:36:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263","run_id":3619},"how_to_check":{"at":"2026-11-11T22:36:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263","run_id":3619},"who_affected":{"at":"2026-11-11T22:36:35Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263","run_id":3619}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["66","fortiauthenticator","fortiauthenticator66"],"ptokens":["fortiauthenticator"],"labels":["fortiauthenticator","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126249':11A,14A '-2026':10A,13A '6.6':17A 'authent':3A 'cve':9A,12A 'escal':6A 'fortiauthent':2A 'fortiauthenticator':15A,16A 'fortinet':1A 'privileg':8A 'user':4A","search_b":"'6.6.0':43B '6.6.10':45B '8.0.0':39B '8.0.3':41B 'account':53B 'alreadi':49B 'applianc':30B 'attack':47B 'authent':29B 'beyond':58B 'flaw':36B 'fortiauthent':18B,24B 'fortinet':19B,25B 'grant':62B 'hold':50B 'host':23B 'ident':27B 'improp':33B 'infrastructur':20B 'manag':35B 'privileg':34B,57B 'rais':55B 'self':22B 'self-host':21B 'valid':52B 'version':38B","search_c":"'6.6.0':75C '6.6.10':77C '8.0.0':71C '8.0.3':73C 'allow':79C 'attack':82C 'authent':81C 'escal':84C 'fortiauthent':70C,74C 'fortinet':69C 'improp':64C 'manag':66C 'may':78C 'privileg':65C,85C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126249","severity":null,"published_at":"2026-11-11T22:17:24+00:00","modified_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126249:3619","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263","severity":null,"published_at":"2026-11-11T22:36:35+00:00","modified_at":"2026-11-11T22:36:35+00:00","first_seen_at":"2026-11-11T22:36:35+00:00","fetched_at":"2026-11-11T22:36:35+00:00","note":"Fortinet PSIRT FG-IR-26-263 read: fixed in 8.0.4 / 6.6.11, no workaround or virtual patch stated, not exploited per vendor. X/discussion not searched (no CVE-specific chatter expected).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-263"]}],"documents":[{"id":129662,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263","title":"Fortinet PSIRT FG-IR-26-263: Improper privilege management (FortiAuthenticator)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}