CVE-2026-22575

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.

Scoring

Severity

MEDIUM

CVSS base score

4.7

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C

CWE

CWE-284

Published

2026-09-08

Last modified

2026-09-08

Affected products

• Fortinet FortiManager
• Fortinet FortiManager
• Fortinet FortiManager
• Fortinet FortiManager
• Fortinet FortiManager
• Fortinet FortiManager Cloud
• Fortinet FortiManager Cloud
• Fortinet FortiManager Cloud

Weakness type

• CWE-284

Related vulnerabilities

• CVE-2026-50165 — alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
• CVE-2026-86774 — Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
• CVE-2026-19625 — IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
• CVE-2026-75998 — ColdFusion | Improper Access Control (CWE-284)
• CVE-2026-86672 — ningzichun Student Management System Backup example.7z information disclosure
• CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
• CVE-2026-77487 — SQL Server Elevation of Privilege Vulnerability
• CVE-2026-73028 — SQL Server Elevation of Privilege Vulnerability

Markdown version · Browse all CVEs