← Back

CVE-2025-57823

nvd nist
Published: Dec 9, 2025Modified: Jun 17, 2026

JSON object

Loading...
2.7
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.2 / Impact: 1.4
Source: psirt@fortinet.com (Secondary)

Description

A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints

Affected (1)

Fortinet
1 product
Fortiauthenticator
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Fortiauthenticator
From 6.3.0 to 6.6.6

Related CWEs

CWE-425
Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.