Fortinet FortiMail Vulnerable to Critical Authorization Bypass Flaw
An unauthenticated remote attacker can exploit a critical authorization bypass vulnerability in FortiMail to take over arbitrary IBE recipient accounts.
Fortinet has disclosed a critical authorization bypass vulnerability, identified as CWE-639, affecting multiple versions of its FortiMail email security gateway. The flaw, which carries a CVSSv3 score of 9.1, allows unauthenticated remote attackers to gain unauthorized access to sensitive information and systems.
The vulnerability stems from an improper access control mechanism that can be exploited through crafted HTTP requests. By manipulating these requests, an attacker can bypass authentication and authorization checks, leading to the takeover of arbitrary IBE (Identity-Based Encryption) recipient accounts. This capability poses a significant risk, as it could allow attackers to intercept, read, or modify encrypted email communications intended for specific recipients.
FortiMail versions ranging from 7.2.0 through 8.0.1 are confirmed to be affected by this vulnerability. The extensive list of impacted versions highlights the widespread potential exposure across organizations utilizing these FortiMail deployments for their email security infrastructure.
While the advisory does not explicitly detail the exploitation methods, the description points to a common attack vector involving specially crafted network traffic. The high CVSSv3 score indicates a severe impact, with potential consequences including data theft, unauthorized access to confidential communications, and disruption of email services.
This vulnerability was discovered internally by Gwendal Guegniaud of the Fortinet Product Security team, with assistance from the Claude Mythos AI model. The disclosure follows Fortinet's standard security advisory process, aiming to inform customers and provide necessary remediation steps.
Fortinet has not yet released specific patches or firmware updates for this particular vulnerability in the advisory. However, users are strongly advised to consult the official Fortinet PSIRT advisory for the latest information on affected versions and recommended mitigation strategies. Given the critical nature and high CVSS score, prompt attention to patching or applying workarounds is crucial for organizations relying on FortiMail.
The discovery by an internal team using AI tools underscores the evolving landscape of vulnerability research and the increasing role of artificial intelligence in identifying complex security flaws. This incident serves as a reminder for organizations to maintain robust security postures and stay informed about advisories from their vendors.
This advisory, FG-IR-26-207, provides further technical details on the vulnerability, including the specific CVE identifier CVE-2026-126155. It also lists a comprehensive set of affected FortiMail versions, ranging from 7.2.0 up to 8.0.1, and assigns a critical CVSSv3 score of 9.1, emphasizing the severity of the authorization bypass.