{"id":"CVE-2026-126242","aliases":["EUVD-2026-123866","GHSA-4jv4-mf6r-8mp9"],"status":"published","title":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3,...","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.00309,"percentile":0.24071,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-11-11T21:31:20Z","modified":"2026-11-12T19:06:19Z","products":[{"vendor":"fortinet","product":"fortiauthenticator"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126242"},{"url":"https://github.com/advisories/GHSA-4jv4-mf6r-8mp9"}],"sources":{"cve":[{"id":"CVE-2026-126242","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.","status":"published","published":"2026-11-11T21:31:20.079Z","modified":"2026-11-13T04:59:17.784Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-11T22:33:40.554088Z"}],"euvd":[{"id":"EUVD-2026-123866","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.","status":"published","published":"2026-11-11T21:31:20Z","modified":"2026-11-13T04:59:17Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-12T20:34:56.908151Z"}],"ghsa":[{"id":"GHSA-4jv4-mf6r-8mp9","title":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3,...","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.","status":"published","published":"2026-11-12T00:32:58Z","modified":"2026-11-12T00:32:59Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-12T00:37:18.265111Z"}],"nvd":[{"id":"CVE-2026-126242","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.","status":"published","published":"2026-11-11T22:17:23.893Z","modified":"2026-11-13T05:18:26.657Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-11T23:26:41.62195Z"}]}}