CVE-2023-48783: medium-severity vulnerability in Fortinet FortiPortal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A user with read-only access to PortiPortal can trick the system into accessing data from other organizations by sending specially crafted requests. This bypasses permission controls that should prevent cross-organization access.
An authorization bypass vulnerability in PortiPortal allows authenticated users with minimal privileges to access endpoints belonging to other organizations through manipulated GET requests. The vulnerability exploits insufficient validation of user-controlled identifiers to enforce organization-level access boundaries, enabling lateral privilege escalation across tenants.
In the same product, most dangerous first.