Skip to content
Sign in
5.3 Medium

CVE-2023-36633 An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5…

Description

An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders of other users via crafted HTTP or HTTPs requests.

Affected products and versions

Product Affected versions Fixed in
FortiMail 7.2 7.2.0 → 7.2.2 No fix stated
FortiMail 7.0 7.0.0 → 7.0.5 No fix stated
FortiMail 6.4 6.4.0 → 6.4.8 No fix stated
FortiMail 6.2 6.2.0 → 6.2.9 No fix stated
FortiMail 6.0 6.0.0 → 6.0.12 No fix stated

Other CVEs of FortiMail

The 24 CVEs of FortiMail →
CVE-2025-57739 An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89]… 7.7 High CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability 9.8 Critical CVE-2025-53681 An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89]… 6.3 Medium CVE-2025-55717 A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through… 3.8 Low
Track this CVE