CVE-2023-36556

8.8 highEPSS 1.1%

High (8.8) in fortinet fortimail. EPSS 1.1% chance of exploitation in the next 30 days.

An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2023-10-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortimail

References

https://fortiguard.com/psirt/FG-IR-23-202
https://fortiguard.com/psirt/FG-IR-23-202

Check your stack JSON