Description

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T13:16:50.963Z",
  "pubdate": "2026-08-17T13:16:50.963Z",
  "executiveSummary": "A Missing Authorization vulnerability has been identified in Dolusoft Software Technologies Fortilogger versions prior to 6.1.5.9. This security flaw stems from an absence of proper access control lists (ACLs) governing specific application functionalities, enabling unauthorized actors to interact with restricted endpoints.\nThe primary impact of this vulnerability is the unauthorized execution of functions that should otherwise be constrained by privilege boundaries, potentially leading to unauthorized data exposure, system manipulation, or administrative function execution depending on the exposed capabilities.\nThe affected product is Dolusoft Software Technologies Fortilogger in versions prior to 6.1.5.9. The risk implications are severe, as exploitation undermines the confidentiality, integrity, and availability guarantees provided by the application's intended authorization architecture.\nAttackers capable of communicating with the vulnerable Fortilogger instance can leverage this flaw to bypass security controls without necessarily possessing the corresponding high-level administrative credentials, assuming network reachability to the vulnerable endpoints.\nAddressing this risk requires immediate application of official vendor patches to remediate the broken access control implementation and restore strict ACL enforcement across all sensitive application routes.",
  "technicalDetails": "The vulnerability is classified under CWE-862 (Missing Authorization), indicating that the software performs an action or grants access to functionality without verifying whether the user has the requisite privileges or permissions to execute the operation safely.\nThe root cause resides within the application routing and request handling logic of Dolusoft Software Technologies Fortilogger before version 6.1.5.9, where certain sensitive functions fail to validate the caller's session tokens, role assignments, or permission mappings against defined ACL policies prior to executing the requested logic.\nThe vulnerable component comprises the backend controllers and request dispatchers responsible for processing administrative or privileged actions within the Fortilogger application architecture. Because these endpoints lack sufficient authorization checks, any entity capable of routing HTTP requests to the target functions can successfully invoke them.\nThe exploitation method involves directly issuing crafted requests, such as HTTP GET or POST methods, to specific, otherwise restricted URLs or API endpoints exposed by the Fortilogger application. The attacker does not need to complete a complex privilege escalation chain if the application logic implicitly trusts the incoming request without contextual session validation.\nThe step-by-step attack flow typically proceeds as follows: First, the attacker maps or identifies the exposed endpoints within the Fortilogger application that handle sensitive operations. Second, the attacker crafts a direct request targeting the unprotected functional endpoint, omitting or providing low-privileged authentication tokens. Third, the backend application processes the request, executing the underlying business logic and returning the result or performing the requested state modification without verifying authorization constraints. Finally, the attacker achieves unauthorized access to restricted application functionality.\nNetwork exposure is inherent to any deployment where the Fortilogger interface is accessible to untrusted networks, although the attack surface may be constrained by network segmentation or perimeter firewalls depending on administrative configurations. Authentication and privilege requirements for exploitation are notably bypassed or degraded due to the flaw, allowing unverified execution of privileged features.\nPost-exploitation impact varies based on the specific functions exposed through the missing authorization flaw, but generally includes unauthorized configuration changes, exposure of sensitive internal system data, or execution of privileged operational routines by unauthorized users."
}