CVE-2026-126155

An incorrect authorization vulnerability [CWE-863] exists in Fortinet FortiMail affecting versions 8.0.0 through 8.0.1 , 7.6.0 through 7.6.6 , 7.4.0 through 7.4.8 , and all versions of 7.2 . This flaw allows an unauthenticated remote attacker to craft HTTP requests to obtain an authenticated IBE ...

CVE-2026-126150

A weak password recovery mechanism (CWE-640) and Missing Authentication for Critical Function (CWE-306) in Fortinet FortiMail versions 8.0.0 , 7.6.0 through 7.6.5 , 7.4.0 through 7.4.7 , and 7.2.0 through 7.2.9 allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail us...

Incorrect authorization

An Incorrect Authorization vulnerability CWE-863 in FortiMail may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests...

Weak password recovery mechanism for forgotten password

A Missing Authentication for Critical Function vulnerability CWE-306 in FortiMail may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests...