FortiMail IBE Webmail Authorization Flaw Exposes Encrypted Mail

A vulnerability in FortiMail could allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient. The issue is an incorrect authorization flaw.

By sending crafted HTTP requests, an attacker can read or send encrypted mail belonging to any IBE recipient.

Affected versions include:

• FortiMail 8.0.0 through 8.0.1
• FortiMail 7.6.0 through 7.6.6
• FortiMail 7.4.0 through 7.4.8
• FortiMail 7.2 all versions