{"id":"CVE-2026-126160","aliases":["EUVD-2026-123833","GHSA-53vv-vq62-6qjw"],"status":"published","title":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6...","description":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-11-11T21:29:19.376Z","modified":"2026-11-12T00:33:03Z","products":[{"vendor":"fortinet","product":"fortimail"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-212"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126160"},{"url":"https://github.com/advisories/GHSA-53vv-vq62-6qjw"}],"sources":{"cve":[{"id":"CVE-2026-126160","description":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.","status":"published","published":"2026-11-11T21:29:19.376Z","modified":"2026-11-11T21:29:19.376Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-11T22:33:40.554088Z"}],"euvd":[{"id":"EUVD-2026-123833","description":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.","status":"published","published":"2026-11-12T00:32:56Z","modified":"2026-11-12T00:32:56Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-12T01:31:24.707094Z"}],"ghsa":[{"id":"GHSA-53vv-vq62-6qjw","title":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6...","description":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.","status":"published","published":"2026-11-12T00:32:56Z","modified":"2026-11-12T00:33:03Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-12T00:37:18.265111Z"}],"nvd":[{"id":"CVE-2026-126160","description":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests.","status":"published","published":"2026-11-11T22:17:13.99Z","modified":"2026-11-11T22:17:13.99Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-11T23:26:41.421267Z"}]}}