CVE-2026-21743
A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions
Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.003
28.6th percentile
Discovered by
Vendor
Vendor advisory field
Published
Feb 10, 2026
Assigned by fortinet
Description
A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint.
Weakness: CWE-862
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiAuthenticator | Identity / IAM / MFA | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiAuthenticator
Credit
Discovered during an independent audit commissioned by Fortinet.
Vendor remediation
Upgrade to FortiAuthenticator version 8.0.0 or above Upgrade to FortiAuthenticator version 6.6.7 or above