FORTINETVERIFIED
Broken Access control on Websocket streams
Checked 8 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.
Open the official publisher source
← Lifecycle catalogue
SECURITY ADVISORYFORTINETVERIFIED
PUBLISHER UPDATE · FORTINET-PRODUCTS-1EFF8F97C4C51441
FORTINET-PRODUCTS-1EFF8F97C4C51441 release notes and known issues
Broken Access control on Websocket streams
Scope: Fortinet products. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.
Summary
CVSSv3 Score: 4.9 An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests Revised on 2026-09-08 00:00:00
Improvements and security content
- CVSSv3 Score: 4.9 An Improper Access control vulnerability [CWE-284] in FortiSOAR may allow an authenticated attacker with zero permissions to subscribe to websocket streams and topics and to inject broadcast messages to the stream via crafted websocket requests Revised on 2026-09-08 00:00:00
Known issues
Publisher statementNot stated. The verified publisher record does not contain a known-issues statement.
Affected products and versions
Products
- Fortinet products
Affected versions
- 4.9
Fixed versions or updates
- No fixed version is stated in this record.
Recommended action
Review the official publisher document before deployment.