FortiAuthenticator CVE-2025-57823

Exploitation requires a valid authenticated account on FortiAuthenticator with at least sponsor permissions (the limited guest-sponsor role), on affected versions 6.6.0 through 6.6.6, or any 6.5, 6.4, or 6.3 release. The attacker must know or discover the specific device-log endpoints that are reachable via direct request/forced browsing because they lack proper authorization enforcement. Limiting factors: the mandatory authenticated privilege gate (no unauthenticated access), the restriction of impact to reading/downloading device logs only (no write, no availability impact), and the need to reach the specific vulnerable endpoints - meaning realistic risk is confined to environments where lower-trust sponsor accounts are provisioned to parties who should not see device logs.

This is a low-priority, low-real-risk issue despite being a network-exploitable flaw. The CVSS 3.1 base score is only 2.7 (Low), with a vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) that reflects limited confidentiality-only impact and a privilege requirement - the attacker must already hold a valid authenticated account with at least sponsor permissions. EPSS reinforces the low urgency at 0.23% (13th percentile), indicating minimal predicted exploitation activity. The vulnerability is NOT in CISA KEV and no public exploit code was identified, so there is no evidence of active exploitation. All signals (low CVSS, low EPSS, no KEV, no POC, authentication gate, confidentiality-only impact limited to device logs) align consistently toward low real-world risk. One point to verify with the vendor: the description characterizes the attacker as holding 'at least sponsor permissions' - a sponsor is a comparatively limited guest-management role in FortiAuthenticator, which arguably supports PR:L rather than the vendor-assigned PR:H; this nuance does not change the overall low severity but affects the precise privilege characterization.

An authenticated FortiAuthenticator user holding a sponsor-level account (normally scoped only to managing guest accounts) directly browses to specific undisclosed endpoints that lack proper authorization enforcement. By doing so, they read and download device logs they are not meant to access, obtaining operational information. No public exploit code is known, and the network attack vector with low complexity makes the request itself trivial once the attacker has valid credentials.