CVE-2023-46712 is a high severity (CVSS 7.2) improper access control flaw in Fortinet FortiPortal. Versions 7.0.0 through 7.0.6 and 7.2.0 through 7.2.1 are affected. Upgrade to 7.0.7 or later, or 7.2.2 or later. Fortinet rates the issue Medium and lists no workaround.
What's affected
FortiPortal 7.0.0 through 7.0.6 and 7.2.0 through 7.2.1 are affected, per the Fortinet PSIRT advisory FG-IR-23-395. Versions 6.0 and 5.3 are not affected. Fixes are 7.0.7 or above and 7.2.2 or above.
There is a labelling difference. NVD calls the score 7.2 High, while Fortinet labels the same 7.2 base score Medium. The advisory says the attack needs authentication, the impact is privilege escalation, and it is not known to be exploited. No workaround is listed. The weakness is CWE-284.
The NVD record scores it 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-284 (improper access control). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Sign in to FortiPortal and read the version in the system information page. Compare with the ranges above. Then review which accounts have administrative rights, because an attacker needs a valid account with high privileges in the vector.
Fortinet's upgrade path tool on its documentation site helps you plan the move. If you run several FortiPortal instances, check each one separately, because tenants are often upgraded at different times.
What to do now
- Upgrade FortiPortal to 7.0.7 or later, or 7.2.2 or later.
- Review administrator and delegated administrator accounts.
- Limit access to the FortiPortal interface to management networks.
- Check access logs for unusual HTTP requests to the admin interface.
- Record the version in your asset inventory.
Why it matters
Improper access control means the server fails to check that a request matches the caller's role. The advisory says crafted HTTP requests can escalate privilege. Management portals for firewalls and security devices are valuable targets, because they hold policy for many other systems.
The score is held down by the need for an existing high privilege account, but a portal that manages several tenants can turn that into broader access.
Quick check
Is there a workaround?
Fortinet lists none. Upgrade.
Why is it called both High and Medium?
NVD labels 7.2 as High and Fortinet labels it Medium. The score is the same.
Sources
Last reviewed: 19 October 2026.
