CVE-2026-22575

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-171

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-08 17:17

Updated : 2026-09-08 18:35

NVD link : CVE-2026-22575

Mitre link : CVE-2026-22575

CVE.ORG link : CVE-2026-22575

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-22575", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22575", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T17:28:52.915929Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortimanager:6.4.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiManager", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "7.6.4"}, {"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.10"}, {"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.12"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.16"}, {"status": "affected", "version": "6.4.0", "versionType": "semver", "lessThanOrEqual": "6.4.15"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortimanagercloud:6.4.1:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiManager Cloud", "versions": [{"status": "affected", "version": "7.6.2", "versionType": "semver", "lessThanOrEqual": "7.6.4"}, {"status": "affected", "version": "7.4.1", "versionType": "semver", "lessThanOrEqual": "7.4.10"}, {"status": "affected", "version": "7.2.1", "versionType": "semver", "lessThanOrEqual": "7.2.12"}, {"status": "affected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.16"}, {"status": "affected", "version": "6.4.1", "versionType": "semver", "lessThanOrEqual": "6.4.7"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-08T17:17:34.407", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-171", "source": "psirt@fortinet.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests."}], "lastModified": "2026-09-08T18:35:10.323", "sourceIdentifier": "psirt@fortinet.com"}