Summary
generated automatically from NVD dataFortinet FortiOS on FortiGate devices, in versions before 5.0.3, fails to properly restrict the capabilities of the Guest role (weakness class CWE-264, permissions and access control). A remote authenticated user holding the Guest role could read, modify, or delete the records of arbitrary other users. The flaw carries a CVSS v2.0 score of 6.5 (MEDIUM), with partial impact on confidentiality, integrity, and availability.
NVD description
Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role.
EPSS · FIRST.org
1.1%probability of exploitation in the next 30 days
Higher than 64% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 25 juin 2013
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-264
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.