Fortinet FortiAnalyzer and FortiManager: Incorrect Authorization (CVE-2026-126215)
An incorrect authorization vulnerability in multiple versions of Fortinet FortiAnalyzer and FortiManager may allow an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services via specially crafted requests to the GUI.
CVE search metadata
CVE search record: CVE-2026-126215. Severity: high. CVSS: 8.2. KEV: no. Product: FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud. Brief: Fortinet FortiAnalyzer and FortiManager: Incorrect Authorization (CVE-2026-126215). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortianalyzer-fortimanager-auth-cve-2026-126215/
Triage facts
Revision 1- Applicability
- FortiAnalyzer, FortiAnalyzer Cloud +2
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:21 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
An incorrect authorization vulnerability (CVE-2026-126215) exists in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud. The flaw may allow an authenticated administrator to escalate their privileges, bypass authorization controls, or impersonate internal services through specially crafted requests sent to the management GUI. The vulnerability has a CVSS v3.1 base score of 8.2.