Fortinet Authorization Bypass Flaw in dmserver

# Fortinet Authorization Bypass Flaw in dmserver

https://gcdradar.vercel.app/incidents/fortinet-authorization-bypass-flaw-in-dmserver · AIR-2026-1868 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Rated critical with a CVSS score of 9.1.
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: No AI role
- Products: FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud
- CVSS: 9.1

## Summary

An authorization bypass vulnerability in FortiManager and FortiAnalyzer allows authenticated administrators to access other VDOMs via crafted HTTP requests. Fortinet has published advisories regarding this issue.

## What to do

Check Fortinet advisory for patch availability and apply updates.

## Latest updates

- 2026-11-10: Authorization bypass through user-controlled key (https://fortiguard.fortinet.com/psirt/FG-IR-26-208)
- 2026-11-10: Authorization bypass through user-controlled key in dmserver (https://fortiguard.fortinet.com/psirt/FG-IR-26-244)

## Sources

- 2026-11-10 Fortinet: Authorization bypass through user-controlled key in dmserver https://fortiguard.fortinet.com/psirt/FG-IR-26-244
- 2026-11-10 Fortinet: Authorization bypass through user-controlled key https://fortiguard.fortinet.com/psirt/FG-IR-26-208

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.