CVE-2025-54838 MEDIUM

CVE-2025-54838

Vendor Fortinet

Product FortiPortal

Weakness CWE-863 · Incorrect authorization

Published December 9, 2025

Last update January 14, 2026

View on NVD All CVEs

CVSS base score

6.4/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:P/RL:X/RC:C

What the vulnerability does

01Description

An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.

Key dates

02Disclosure timeline

December 9, 2025 CVE published

January 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-54838 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html

Related vulnerabilities

04Related CVE

CVE-2021-24757 Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload CVE-2026-33477 FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content CVE-2023-48227 Umbraco CMS Backoffice User can bypass "Publish" restriction CVE-2024-21735 Improper Authorization check in SAP LT Replication Server CVE-2024-50419 WordPress Greenshift plugin <=9.7 - Broken Access Control vulnerability