CVE-2025-59923 — Improper Access Control in Fortinet Fortiauthenticator

CWE-284 — Improper Access Control4 documents4 sources
Severity
2.7LOWNVD
EPSS
0.0%
top 86.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortiauthenticator
Timeline
PublishedDec 9

Description

An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NExploitability: 1.2 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5fortinet/fortiauthenticator6.6.0 — 6.6.6+2
▶NVDfortinet/fortiauthenticator6.3.0 — 6.6.4

🔴Vulnerability Details

2
CVEList
CVE-2025-59923: An improper access control vulnerability in Fortinet FortiAuthenticator 6↗2025-12-09
▶
GHSA
GHSA-g43v-3rf4-64c9: An improper access control vulnerability in Fortinet FortiAuthenticator 6↗2025-12-09
▶

📋Vendor Advisories

1
Fortinet
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all...↗2025-12-09
▶
CVE-2025-59923 — Improper Access Control in Fortinet | cvebase