{"id":"CVE-2026-70466","aliases":["EUVD-2026-57192","GHSA-hf6p-246f-w422"],"status":"published","title":"A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2,...","description":"A incomplete list of disallowed inputs vulnerability [CWE-184] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via specifically crafted requests.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0031,"percentile":0.24066,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-184"],"published":"2026-08-12T12:19:02Z","modified":"2026-11-06T15:42:17Z","products":[{"vendor":"fortinet","product":"fortiweb"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-157","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70466"},{"url":"https://github.com/advisories/GHSA-hf6p-246f-w422"}],"sources":{"cve":[{"id":"CVE-2026-70466","description":"A incomplete list of disallowed inputs vulnerability [CWE-184] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via specifically crafted requests.","status":"published","published":"2026-08-12T12:19:02.791Z","modified":"2026-11-06T15:42:17.047Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-184"],"updated_at":"2026-11-06T16:58:46.729138Z"}],"euvd":[{"id":"EUVD-2026-57192","description":"A incomplete list of disallowed inputs vulnerability [CWE-184] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via specifically crafted requests.","status":"published","published":"2026-08-12T12:19:02Z","modified":"2026-11-06T15:42:17Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-06T17:05:30.233809Z"}],"ghsa":[{"id":"GHSA-hf6p-246f-w422","title":"A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2,...","description":"A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via \u003cinsert attack vector here\u003e","status":"published","published":"2026-08-12T15:30:44Z","modified":"2026-08-12T15:30:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:10:22.744469Z"}],"nvd":[{"id":"CVE-2026-70466","description":"A incomplete list of disallowed inputs vulnerability [CWE-184] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via specifically crafted requests.","status":"published","published":"2026-08-12T13:17:24.883Z","modified":"2026-11-06T16:18:58.367Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-184"],"updated_at":"2026-11-06T18:00:52.991057Z"}]}}