Improper Authorization in Fortinet FortiOS and FortiProxy Affects Multiple Versions
CVE-2025-54822

4.2MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortiproxy
FortiOS
Vendor
CVE Published:
14 October 2025

What is CVE-2025-54822?

An improper authorization vulnerability exists in Fortinet FortiOS and FortiProxy products that could allow an authenticated attacker to exploit this flaw and gain unauthorized access to static files belonging to other Virtual Domain (VDOM) instances. This issue impacts FortiOS versions 7.4.0 to 7.4.1 and versions prior to 7.2.8, as well as FortiProxy versions before 7.4.8, enabling the potential for unauthorized data exposure through specially crafted HTTP or HTTPS requests. Proper security measures are recommended to mitigate this risk.

Affected Version(s)

FortiOS 7.4.0 <= 7.4.1

FortiOS 7.2.0 <= 7.2.8

FortiOS 7.0.0 <= 7.0.11

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-684

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-54822 : Improper Authorization in Fortinet FortiOS and FortiProxy Affects Multiple Versions