What is the CVSS score of CVE-2026-49938?

CVE-2026-49938 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Fortinet FortiPortal CVE-2026-49938

EUVD-2026-35442 MEDIUM

Improper Access Control (CWE-284)

2026-06-09 fortinet

GHSA-ccch-q89j-28hm

Authentication Bypass Fortinet Fortiportal

6.5

CVSS 3.1 · Vendor: fortinet

Severity by source

Vendor (fortinet) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (fortinet) · only source for this CVE.

CVSS VectorVendor: fortinet

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 09, 2026 - 16:22 NVD

6.2 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 15:48 vuln.today

CVE Published

Jun 09, 2026 - 14:27 nvd

MEDIUM 6.2

DescriptionCVE.org

A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, FortiPortal 7.0 all versions may allow attacker to improper access control via <insert attack vector here>

AnalysisAI

Improper access control in Fortinet FortiPortal versions 7.0.x (all), 7.2.0-7.2.8, and 7.4.0-7.4.7 enables an authenticated low-privilege attacker to bypass authorization controls and gain unauthorized read access to sensitive data. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) indicates low-complexity network exploitation by any authenticated user, resulting in high confidentiality impact with no integrity or availability loss. No public exploit identified at time of analysis based on CISA KEV, though publicly available exploit code exists per the CVSS temporal E:P metric, and Fortinet has issued an official fix.

Technical ContextAI

FortiPortal is Fortinet's multi-tenant management portal, primarily used by MSSPs and enterprise customers to manage FortiGate security policies, firewall configurations, and network telemetry across customer tenants. CWE-284 (Improper Access Control) identifies the root cause as a failure to enforce authorization boundaries - the system permits authenticated low-privilege users to access resources, API endpoints, or data structures that should require elevated privileges. The 'Authentication Bypass' tag in conjunction with CWE-284 and the PR:L CVSS parameter suggests vertical or horizontal privilege escalation within FortiPortal's role-based access model, potentially exposing cross-tenant data or administrative functions. The affected CPE (cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*) encompasses the full FortiPortal application across the named version ranges. The CVE description contains a placeholder ('<insert attack vector here>'), indicating the precise exploitation mechanism within the portal has not been fully disclosed in the available data.

RemediationAI

Fortinet has released an official fix per the CVSS temporal RL:O metric and the PSIRT advisory FG-IR-26-140 at https://fortiguard.fortinet.com/psirt/FG-IR-26-140; however, the exact patched version numbers are not specified in the available data and must be confirmed directly from the Fortinet advisory before upgrading. Administrators should prioritize reviewing the advisory for the target upgrade version and apply the patch immediately, particularly given publicly available proof-of-concept code. As interim compensating controls prior to patching: restrict network access to FortiPortal's management interface to trusted IP ranges via upstream firewall ACLs (trade-off: operational impact for remote administrators); audit and minimize low-privilege accounts with portal access, removing any unnecessary accounts that could be leveraged; and enable enhanced logging on FortiPortal access events to detect anomalous cross-role data access attempts. Network-level restrictions reduce attack surface but do not remediate the underlying access control flaw.