CVE-2023-47543 is an authorization bypass through a user-controlled key in Fortinet FortiPortal 7.0.0 through 7.0.3. NVD scores it 5.4, Medium. An authenticated attacker could interact with resources that belong to other organizations. Fortinet's fix is FortiPortal 7.0.4 or later. Check any multi-tenant portal now.
What's affected
Fortinet's advisory FG-IR-23-448, published 12 November 2024, lists FortiPortal 7.0.0 through 7.0.3 as affected, with the solution to upgrade to 7.0.4 or above. FortiPortal 7.4, 7.2 and 6.0 are listed as not affected.
The NVD record agrees on the range. Its vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. Fortinet also labels the severity Medium with a CVSS v3 score of 5.4, and its temporal score is 5.1. No conflict on severity or versions between the two.
The component is the administrative GUI. The weakness is CWE-639, authorization bypass through user-controlled key. The advisory marks the issue as internally discovered and not known to be exploited. It lists the impact as improper access control.
How to check if you're exposed
Open FortiPortal and read the version from the system information. If it is in the 7.0 line and below 7.0.4, it needs the upgrade.
FortiPortal is the multi-tenant management portal that managed service providers use to give customers a view of their FortiGate devices. Because the flaw is about crossing organizational boundaries, the question to ask is whether you host more than one customer or business unit on the same portal. If you have a single organization, the practical exposure is smaller.
Review the portal's audit logs for administrators or users acting on objects outside their own organization, and for requests that reference identifiers belonging to other organizations.
What to do now
- Upgrade FortiPortal 7.0 to 7.0.4 or later.
- If you run 6.0, 7.2 or 7.4, no action is needed for this CVE according to Fortinet.
- Review the accounts with access to the portal, and remove those that are no longer in use.
- Check the audit logs for cross-organization access since you installed an affected version.
- If you serve several customers, tell your security contact how the exposure was assessed, so the record is clear later.
Why it matters
A user-controlled key is an identifier the client supplies, such as an organization number or object reference. If the server uses it to fetch data without checking that the signed-in user owns the object, changing the identifier is enough to reach someone else's data. The usual name for this is an insecure direct object reference, and CWE-639 is its entry in the weakness list.
The score is Medium because the attacker must already hold a valid account, and the vector rates the impact on confidentiality and integrity as Low. In a multi-tenant product the real weight comes from the trust boundary. Customers expect their data and settings to be invisible to the other tenants on the same portal. One missed ownership check is enough to break that.
The fix pattern is a server side check that ties every object request to the account's organization. It belongs in a shared layer so it cannot be forgotten on one route.
Quick check
Does this affect FortiPortal 7.2 or 7.4?
No. Fortinet lists both as not affected.
Does an attacker need an account?
Yes. Fortinet marks the attack type as authenticated, and NVD's vector requires low privileges.
Sources
Last reviewed: 19 October 2026.
