FortiNAC - Report disclosure to unauthenticated users


An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests.

Affected Products

At least
FortiNAC version 9.4.0 through 9.4.1
FortiNAC 9.2 all versions
FortiNAC 9.1 all versions
FortiNAC 8.8 all versions
FortiNAC 8.7 all versions


Please upgrade to FortiNAC-F version 7.2.0 or above
Please upgrade to FortiNAC version 9.4.2 or above


Fortinet is pleased to thank KPN for bringing this issue to our attention under responsible disclosure.


2023-04-03: Initial publication