CVE-2025-59923CWE-284broken-access-control

CVE-2025-59923

Low · published December 9, 2025

CVSS v3.1
2.7
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-12-09T23:15Z
Affected products (1)
ProductVersionsFixed in
fortinet/fortiauthenticator≥ 6.3.0, ≤ 6.6.4—
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-25-616 · [email protected]
EPSS history
Timeline
  • 09 DEC 17:18Z
    An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all…
    cvelistv5