FortiAuthenticator CVE-2025-59923

Exploitation requires the attacker to already hold a valid FortiAuthenticator administrator account with at least read-only admin permission; from there, crafted requests to the administrative interface expose the messaging-service credentials belonging to other administrators. Affected builds are FortiAuthenticator 6.6.0 through 6.6.6 and all versions of 6.5, 6.4, and 6.3. The principal limiting factor is the privilege prerequisite (PR:H) - this cannot be exploited by unauthenticated or non-admin users - which confines realistic risk to deployments that provision lower-trust read-only admin roles to operators who should not have access to peer administrators' stored service credentials. No end-user interaction is required.

This is a low-priority issue despite being a Fortinet appliance vulnerability. The signals are consistent and all point low: CVSS base score is 2.7 (LOW) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, meaning network-reachable but requiring high privileges (an existing admin account) and yielding only limited confidentiality impact with no integrity or availability effect. EPSS corroborates this at 0.21% (11th percentile), indicating very low probability of exploitation in the wild. There is no CISA KEV listing and no public exploit identified, so active exploitation is not indicated. The CVSS and EPSS signals agree rather than conflict. The one caveat is a dependency not a contradiction: an attacker must already be an authenticated read-only administrator, so this functions as a privilege/trust-boundary weakness (CWE-284 improper access control) between admin roles rather than a remote pre-auth flaw. The input 'Authentication Bypass' tag is misleading - the description explicitly requires an authenticated admin, so this is an access-control/privilege-scoping issue, not a bypass. Real-world risk is limited to environments where lower-trust (read-only) admin accounts exist and are held by less-trusted operators.

A user granted a read-only administrator account on FortiAuthenticator (for example, a help-desk operator or auditor) sends crafted requests to the administrative interface and retrieves the stored messaging-service credentials (e.g., SMTP/SMS gateway credentials) configured by other, higher-privileged administrators. No public exploit code is identified at time of analysis, and the attacker-side complexity is low once admin access is held.