Fortinet FortiMail: Authorization bypass and arbitrary file deletion (CVE-2026-126152)

CVE-2026-126152 is an authorization bypass vulnerability affecting multiple versions of Fortinet FortiMail. The vulnerability stems from improper handling of user-controlled keys, which allows an authenticated remote attacker to bypass security constraints. By sending crafted HTTP requests to the webmail and administrative interfaces, an attacker can delete arbitrary directories with root privileges or manipulate sensitive mailbox and calendar data belonging to other tenants.

Impact

Successful exploitation can result in unauthorized access to sensitive cross-tenant user data, including mailbox and calendar entries, and directory deletion with root privileges, potentially leading to service disruption or system instability.

Recommendation

• Identify all internet-facing or internal FortiMail instances within the infrastructure.
• Consult the official Fortinet security advisory for the specific patched versions for FortiMail 8.0, 7.6, 7.4, and 7.2.
• Apply the vendor-supplied patches to all affected FortiMail installations immediately.
• Review webserver and administrative access logs for unusual, high-frequency requests to webmail or admin interfaces originating from authenticated users.