This vulnerability affects Fortinet FortiSOAR PaaS and on-premise deployments from versions 7.3 up to 7.6.3. It allows an authenticated attacker to obtain cleartext passwords in responses related to Secure Message Exchange and Radius queries if these are configured. The vulnerability is due to cleartext transmission of sensitive information. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality impact. An official patch is available to remediate this issue.

The vulnerability allows an authenticated attacker to view sensitive passwords in cleartext, potentially compromising authentication credentials for Secure Message Exchange and Radius services. This could lead to unauthorized access or further attacks leveraging the disclosed credentials. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available for this vulnerability. It is recommended to apply the vendor-provided patch or update to a fixed version of FortiSOAR PaaS or on-premise as soon as possible. Since this is not a cloud service, remediation is the responsibility of the deploying organization. No additional mitigation steps are indicated by the vendor advisory.