What is CVE-2025-59923?

CVE-2025-59923 is a low-severity vulnerability in Fortinet Fortiauthenticator, classified under Improper Access Control. CVSS score: 2.7/10. Published 2025-12-09.

How severe is CVE-2025-59923?

Low severity. CVSS v3 base score is 2.7 out of 10.

Vulnerability in Fortinet Fortiauthenticator

CVE-2025-59923

An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.

EPSS: 0.002 (11.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.

Affected products

Fortinet Fortiauthenticator — versions 6.6.0, 6.5.0, 6.4.0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-59923?: CVE-2025-59923 is a low-severity vulnerability in Fortinet Fortiauthenticator, classified under Improper Access Control. CVSS score: 2.7/10. Published 2025-12-09.
How severe is CVE-2025-59923?: Low severity. CVSS v3 base score is 2.7 out of 10.