Fortinet FortiMail: Authorization bypass via user-controlled key (CVE-2026-126156)
An unauthenticated remote attacker can bypass authorization in Fortinet FortiMail to take over an arbitrary Identity-Based Encryption (IBE) recipient account by sending crafted HTTP requests.
CVE search metadata
CVE search record: CVE-2026-126156. Severity: critical. CVSS: 9.1. KEV: no. Product: FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions. Brief: Fortinet FortiMail: Authorization bypass via user-controlled key (CVE-2026-126156). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126156/
Triage facts
Revision 1- Applicability
- FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 +2
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Fortinet FortiMail contains an authorization bypass vulnerability (CVE-2026-126156) stemming from a user-controlled key flaw. This vulnerability enables an unauthenticated remote attacker to gain control over an arbitrary Identity-Based Encryption (IBE) recipient account through specially crafted HTTP requests.
Impact
Successful exploitation allows an unauthenticated attacker to take over arbitrary IBE recipient accounts. The vulnerability has a CVSS v3.1 base score of 9.1.