An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fortinac | Fortinet | 9.2.0 (including) | 9.2.7 (excluding) |
| Fortinac | Fortinet | 9.4.0 (including) | 9.4.2 (excluding) |
| Fortinac-f | Fortinet | * | 7.2.0 (excluding) |