FortiSOAR CVE-2025-59810

Exploitation requires the attacker to hold valid authenticated credentials on an affected FortiSOAR instance (PR:L) - FortiSOAR PaaS or on-premise versions 7.6.0-7.6.2, 7.5.0-7.5.1, and all 7.4 and 7.3 releases. The attacker must send specifically crafted requests to endpoints that fail to enforce proper access controls (CWE-284). Limiting factors: no code execution, modification, or disruption is possible (I:N/A:N) - impact is confined to reading data the account should not access; a valid account is mandatory, so fully anonymous/external attackers cannot exploit it, and it does not apply to versions outside the listed ranges. The exact feature or request type is not specified in the available data.

This is a moderate-severity, authenticated information-disclosure flaw (CVSS 6.5) whose signals align consistently toward lower-priority-but-legitimate rather than emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms network reachability with low attack complexity but requires at least low-level authenticated access (PR:L), and limits impact to confidentiality only (C:H, I:N, A:N) - no integrity or availability loss. EPSS is low at 0.26% (17th percentile), there is no CISA KEV listing and no public proof-of-concept identified, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. All signals agree this is a real but non-urgent issue: prioritize it as part of normal patch cycles rather than as an actively-exploited emergency. One data tension to note: the input Tag 'Authentication Bypass' conflicts with both the description ('authenticated attacker') and the CVSS PR:L metric - this is improper access control by an already-authenticated user, not a pre-auth authentication bypass; treat the 'Authentication Bypass' label as suspect pending vendor confirmation.

An attacker who already holds a valid low-privileged FortiSOAR account (PaaS or on-premise, versions 7.3 through 7.6.2) sends crafted API/HTTP requests that bypass object-level access controls, returning data belonging to other tenants, users, or privilege levels they should not be able to read. No public exploit code is known, but the low attack complexity (AC:L) means a knowledgeable authenticated user could likely reproduce it once the specific endpoint is identified.