{"id":"CVE-2026-126151","aliases":["EUVD-2026-123828","GHSA-p457-9wpj-6qgw"],"status":"published","title":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0...","description":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R","level":"high","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-303"],"published":"2026-11-11T21:29:14.136Z","modified":"2026-11-12T00:32:56Z","products":[{"vendor":"fortinet","product":"fortimail"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126151"},{"url":"https://github.com/advisories/GHSA-p457-9wpj-6qgw"}],"sources":{"cve":[{"id":"CVE-2026-126151","description":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.","status":"published","published":"2026-11-11T21:29:14.136Z","modified":"2026-11-11T21:29:14.136Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R","level":"high","assessor":"cna"}],"cwes":["CWE-303"],"updated_at":"2026-11-11T22:33:40.554088Z"}],"euvd":[{"id":"EUVD-2026-123828","description":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.","status":"published","published":"2026-11-12T00:32:55Z","modified":"2026-11-12T00:32:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:R","level":"high"}],"updated_at":"2026-11-12T01:31:24.707094Z"}],"ghsa":[{"id":"GHSA-p457-9wpj-6qgw","title":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0...","description":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.","status":"published","published":"2026-11-12T00:32:55Z","modified":"2026-11-12T00:32:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-303"],"updated_at":"2026-11-12T00:37:18.265111Z"}],"nvd":[{"id":"CVE-2026-126151","description":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request.","status":"published","published":"2026-11-11T22:17:12.72Z","modified":"2026-11-11T22:17:12.72Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-303"],"updated_at":"2026-11-11T23:26:41.421267Z"}]}}