This vulnerability in Fortinet FortiPortal involves improper access control that could allow an attacker with low privileges to gain unauthorized access to resources or functionality. The affected versions include 7.4.0 through 7.4.7, 7.2.0 through 7.2.8, and all 7.0 versions. The CVSS vector indicates network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact, and an official fix remediation level. No known exploits in the wild have been reported at this time.

An attacker with low privileges may exploit this vulnerability to gain unauthorized access to sensitive information or functionality within FortiPortal, potentially leading to confidentiality breaches. There is no impact on integrity or availability reported. The vulnerability does not require user interaction and can be exploited remotely over the network.

An official fix is available from Fortinet to remediate this vulnerability. Users should apply the vendor-provided patches for FortiPortal versions 7.4.0 through 7.4.7, 7.2.0 through 7.2.8, and all 7.0 versions as soon as possible to mitigate the risk. Since this is not a cloud service, patching must be performed by the customer.