CVE-2026-126152
EUVD-2026-12382911.11.2026, 22:17
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| fortinet | fortimail | 8.0.0 ≤ 𝑥 ≤ 8.0.1 | CNA |
| fortinet | fortimail | 7.6.0 ≤ 𝑥 ≤ 7.6.6 | CNA |
| fortinet | fortimail | 7.4.0 ≤ 𝑥 ≤ 7.4.8 | CNA |
| fortinet | fortimail | 7.2.0 ≤ 𝑥 ≤ 7.2.9 | CNA |
| fortinet | fortimail | 7.0.0 ≤ 𝑥 ≤ 7.0.9 | CNA |
Common Weakness Enumeration
Vulnerability Media Exposure