CVE-2023-36556 is an authorization bypass vulnerability classified under CWE-863 affecting Fortinet FortiMail webmail versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.5, and versions below 6.4.7. The flaw arises from incorrect authorization checks in the webmail interface, allowing an authenticated attacker to impersonate other users within the same web domain by sending specially crafted HTTP or HTTPS requests. This vulnerability enables attackers with valid credentials to escalate privileges and access other users' mailboxes without proper authorization. The vulnerability impacts confidentiality, integrity, and availability since unauthorized access to email accounts can lead to data leakage, manipulation of emails, and disruption of mail services. The CVSS v3.1 base score is 8.6 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and full impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and potential impact make this a critical issue for organizations relying on FortiMail for secure email gateway services. FortiMail is widely used in enterprise environments for email security, making this vulnerability a significant risk if left unpatched.

For European organizations, the impact of CVE-2023-36556 can be severe. Unauthorized access to email accounts can lead to exposure of sensitive communications, intellectual property theft, and regulatory non-compliance, especially under GDPR requirements for data protection. Attackers could manipulate or delete emails, disrupt business communications, or use compromised accounts to launch further attacks such as phishing or lateral movement within networks. Organizations in sectors like finance, healthcare, government, and critical infrastructure are particularly at risk due to the sensitive nature of their communications. The breach of confidentiality and integrity of email data can result in financial losses, reputational damage, and legal penalties. Additionally, since FortiMail is often deployed as a perimeter defense, compromise here could undermine overall network security posture.

1. Immediately upgrade FortiMail to the latest patched versions beyond 7.2.2, 7.0.5, or 6.4.7 as provided by Fortinet once available. 2. Until patches are applied, restrict access to the FortiMail webmail interface to trusted networks or VPNs to reduce exposure. 3. Implement strong multi-factor authentication (MFA) for all FortiMail users to reduce risk from compromised credentials. 4. Monitor FortiMail logs for unusual access patterns or multiple account access attempts from single authenticated sessions. 5. Conduct regular audits of user permissions and session management configurations to ensure proper authorization controls. 6. Employ network-level protections such as web application firewalls (WAFs) with custom rules to detect and block suspicious crafted HTTP/HTTPS requests targeting FortiMail. 7. Educate users about credential security and phishing risks to prevent initial account compromise. 8. Coordinate with Fortinet support for any available workarounds or mitigations until official patches are deployed.