Fortinet FortiMail: Incorrect authorization in IBE webmail (CVE-2026-126155)
An incorrect authorization vulnerability in Fortinet FortiMail allows an unauthenticated attacker to hijack Identity-Based Encryption (IBE) webmail sessions and access or send encrypted messages via crafted HTTP requests.
CVE search metadata
CVE search record: CVE-2026-126155. Severity: critical. CVSS: 9.1. KEV: no. Product: FortiMail (8.0.0-8.0.1), FortiMail (7.6.0-7.6.6), FortiMail (7.4.0-7.4.8), FortiMail (7.2.x). Brief: Fortinet FortiMail: Incorrect authorization in IBE webmail (CVE-2026-126155). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimail-auth-bypass-cve-2026-126155/
Triage facts
Revision 1- Applicability
- FortiMail (8.0.0-8.0.1), FortiMail (7.6.0-7.6.6) +2
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Fortinet FortiMail is affected by an incorrect authorization vulnerability (CVE-2026-126155) that enables unauthenticated remote attackers to obtain an authenticated session for the Identity-Based Encryption (IBE) webmail portal. By sending specifically crafted HTTP requests to the target system, an attacker can impersonate any IBE recipient, granting unauthorized access to read encrypted mail or send mail on behalf of the victim.
Impact
Successful exploitation allows unauthorized access to sensitive encrypted communications and the ability to send emails as legitimate users, potentially leading to information disclosure and business process compromise. The vulnerability is rated with a CVSS v3.1 base score of 9.1.
Recommendation
Inventory all instances of Fortinet FortiMail running version 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, or any version of 7.2. Ensure these systems are prioritized for security updates according to Fortinet guidance. Monitor web server logs for anomalous HTTP requests directed at the IBE webmail portal, specifically focusing on unusual session parameters or unauthorized access attempts from public-facing interfaces.
Immediate actions
Inventory and patch all affected FortiMail instances to the latest vendor-recommended secure version
Threat Hunt
Monitor web server access logs for anomalous, high-frequency, or repeated requests directed at the IBE webmail endpoints, particularly those containing suspicious parameters or unexpected session-related headers.
Data: FortiMail web server access logs, HTTP request headers, Client IP addresses