CVE-2025-59810CWE-284broken-access-control

CVE-2025-59810

Medium · published December 9, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow information disclosure to an authenticated attacker via crafted requests

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-12-09T23:15Z
Affected products (2)
ProductVersionsFixed in
fortinet/fortisoar≥ 7.3.0, < 7.5.27.5.2
fortinet/fortisoar≥ 7.6.0, < 7.6.37.6.3
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-25-601 · [email protected]
EPSS history
Timeline
  • 09 DEC 17:19Z
    An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions…
    cvelistv5