CVE-2025-59810

MediumCVSS 6.5/10Last modified Oct 14, 2026

Description

An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow information disclosure to an authenticated attacker via crafted requests

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Dec 9, 2025
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-598148.8This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enab CVE-2025-598158.4This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, CVE-2025-598167.3This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin d CVE-2025-598178.4This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges CVE-2025-598189.8This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded CVE-2025-598196.5This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.CVE-2025-59827.5An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Und CVE-2025-598206.7In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.CVE-2025-598216.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s CVE-2025-598227.5Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTT CVE-2025-598239.9Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Ga CVE-2025-598245.4Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential