CVE-2022-39945: Fortinet FortiMail

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).

Affected products

• Fortinet FortiMail: from 6.0.0, up to and including 6.0.12; from 6.2.0, up to and including 6.2.9; from 6.4.0, up to and including 6.4.7; from 7.0.0, up to and including 7.0.3; version 7.2.0 only

Published 2022-11-02. Last modified 2026-06-17.