Fortinet FortiMail: Authorization bypass via quarantine request (CVE-2026-126159)
An authorization bypass vulnerability in Fortinet FortiMail allows an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted request.
CVE search metadata
CVE search record: CVE-2026-126159. Severity: high. CVSS: 7.5. KEV: no. Product: FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions. Brief: Fortinet FortiMail: Authorization bypass via quarantine request (CVE-2026-126159). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimail-bypass-cve-2026-126159/
Triage facts
Revision 1- Applicability
- FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 +2
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Fortinet FortiMail contains an authorization bypass vulnerability (CVE-2026-126159) resulting from a user-controlled key. This allows an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes by sending a crafted quarantine release request.
Impact
The vulnerability allows unauthorized manipulation of quarantined email messages. The CVSS v3.1 base score is 7.5.
Recommendation
Review environments for affected versions to determine upgrade requirements per official vendor guidance.