Description
A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiAuthenticator | 6.6.0 – ≤ 6.6.6, 6.5.0 – ≤ 6.5.7, 6.4.0 – ≤ 6.4.11, 6.3.0 – ≤ 6.3.5 | — |
Advisories 1
- NCSC-2026-0060 Kwetsbaarheden verholpen in Fortinet FortiSandbox, FortiAuthenticator en FortiClient NCSC-NL (Netherlands) · Feb 11, 2026