CVE-2023-36556

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
FortinetFortiMail>= 7.2.0, <= 7.2.2; >= 7.0.0, <= 7.0.5; >= 6.4.0, <= 6.4.7; >= 6.2.0, <= 6.2.9; >= 6.0.0, <= 6.0.12

References

Timeline

Published
Oct 10, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-365577.8PrintHTML API Remote Code Execution VulnerabilityCVE-2023-365585.5ASP.NET Core Security Feature Bypass VulnerabilityCVE-2023-365594.2Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36569.8cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauCVE-2023-365608.8ASP.NET Security Feature Bypass VulnerabilityCVE-2023-365617.3Azure DevOps Server Elevation of Privilege VulnerabilityCVE-2023-365627.1Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-365635.5Microsoft WordPad Information Disclosure VulnerabilityCVE-2023-365646.5Windows Search Security Feature Bypass VulnerabilityCVE-2023-365657.0Microsoft Office Graphics Elevation of Privilege VulnerabilityCVE-2023-365666.5Microsoft Common Data Model SDK Denial of Service VulnerabilityCVE-2023-365677.5Windows Deployment Services Information Disclosure Vulnerability
CVE-2023-36556: High severity, CVSS 8.8 | Vulnix