Skip to content
fr Sign in
6.5 Medium

CVE-2025-59808 An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2,…

Description

An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an attacker who has already gained access to a victim's user account to reset the account credentials without being prompted for the account's password

Affected products and versions

Product Affected versions Fixed in
FortiSOAR on-premise 7.6 7.6.0 → 7.6.2 No fix stated
FortiSOAR on-premise 7.5 7.5.0 → 7.5.1 No fix stated
FortiSOAR on-premise 7.4 7.4.0 → 7.4.5 No fix stated
FortiSOAR on-premise 7.3 7.3.0 → 7.3.3 No fix stated
FortiSOAR PaaS 7.6 7.6.0 → 7.6.2 No fix stated
FortiSOAR PaaS 7.5 7.5.0 → 7.5.1 No fix stated
FortiSOAR PaaS 7.4 7.4.0 → 7.4.5 No fix stated
FortiSOAR PaaS 7.3 7.3.0 → 7.3.3 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FortiSOAR on-premise

The 13 CVEs of FortiSOAR on-premise →
CVE-2026-84385 A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through… 4.9 Medium CVE-2026-22573 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSOAR… 6.2 Medium CVE-2026-23708 A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through… 6.7 Medium CVE-2025-59809 A server-side request forgery (ssrf) vulnerability [CWE-918] vulnerability in Fortinet FortiSOAR PaaS 7.6.4, FortiSOAR… 4.1 Medium
Track this CVE