What is GHSA-gg72-56wf-8rvm?

GHSA-gg72-56wf-8rvm is a security advisory published by GitHub Security Advisories with Critical severity. A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0...

Which CVE IDs does GHSA-gg72-56wf-8rvm cover?

GHSA-gg72-56wf-8rvm covers the following CVE IDs: CVE-2026-126150. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gg72-56wf-8rvm?

GHSA-gg72-56wf-8rvm has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-gg72-56wf-8rvmCriticalCVSS 9.1

A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0...

Vendor

GitHub Security Advisories

Published

November 12, 2026

Last Modified

November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-126150 →

📋 Description

A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-126150
https://fortiguard.fortinet.com/psirt/FG-IR-26-202
https://github.com/advisories/GHSA-gg72-56wf-8rvm