CVE-2021-41013: Fortinet FortiWeb

Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days.

An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.

Affected products

• Fortinet FortiWeb: from 6.3.0, up to and including 6.3.15; version 6.4.0 only; version 6.4.1 only

Published 2021-12-08. Last modified 2026-06-17.