CVE-2026-49938

MediumCVSS 6.5

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

Fortinet FortiPortal versions 7.4.0 through 7.4.7, 7.2.0 through 7.2.8, and 7.0.x contain an improper access control vulnerability that may allow an attacker to gain unauthorized access via an unspecified attack vector.

Risk Assessment

The risk involves potential unauthorized access to sensitive data or system functions, which could lead to confidentiality and integrity breaches.

Recommendation

Update FortiPortal to the latest available version and implement proper access control policies as per vendor documentation.

Other vulnerabilities in FortiPortal

CVE-2025-54838Medium
An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.

Original NVD description (English source)

A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, FortiPortal 7.0 all versions may allow attacker to improper access control via <insert attack vector here>

Vulnerability data from NVD (NIST) · CISA KEV · EPSS