CVE-2024-46671: Fortinet FortiWeb Auth Bypass Vulnerability

CVE-2024-46671 Overview

CVE-2024-46671 is an Incorrect User Management vulnerability [CWE-286] affecting Fortinet FortiWeb. The flaw resides in the widgets dashboard component and allows an authenticated attacker holding at least read-only administrator permissions to perform operations on the dashboards of other administrators through crafted requests. The vulnerability affects FortiWeb 7.6.2 and below, 7.4.6 and below, 7.2.10 and below, and 7.0.11 and below.

Critical Impact
An authenticated low-privileged administrator can manipulate another administrator's dashboard, breaching the intended separation of administrative user contexts and potentially altering monitoring visibility.

Affected Products

Fortinet FortiWeb 7.6.0 through 7.6.2
Fortinet FortiWeb 7.4.0 through 7.4.6
Fortinet FortiWeb 7.2.0 through 7.2.10 and 7.0.0 through 7.0.11

Discovery Timeline

2025-04-08 - CVE-2024-46671 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46671

Vulnerability Analysis

The vulnerability is classified under CWE-286: Incorrect User Management. FortiWeb's dashboard widget management endpoints fail to correctly bind dashboard operations to the invoking administrator's user context. An authenticated attacker with read-only admin permissions can issue crafted HTTP requests that target dashboard widgets belonging to other administrator accounts.

Exploitation requires valid administrator credentials, but the required privilege level is minimal. Read-only administrator accounts are typically issued to auditors, network operations staff, or third-party integrators who should have no ability to change another administrator's configuration or view. The dashboard permission check treats the target dashboard identifier as trusted user input rather than validating it against the caller's ownership.

Root Cause

The root cause is missing user-scope validation on dashboard widget operations. Requests specifying a target dashboard or administrator identifier are processed without verifying that the identifier matches the authenticated session's user. This is a classic access control failure at the object level rather than at the route level.

Attack Vector

The attack vector is network-based against the FortiWeb management interface. The attacker authenticates using any administrator credential set that carries read-only permissions or higher, then submits crafted requests to the dashboard widget API. No user interaction is required from the targeted administrator. Successful exploitation modifies the state of another administrator's dashboard, which can be used to hide indicators, alter displayed metrics, or otherwise interfere with operational visibility.

See the Fortinet Security Advisory FG-IR-24-184 for vendor-supplied technical details.

Detection Methods for CVE-2024-46671

Indicators of Compromise

Dashboard widget modification events in FortiWeb audit logs where the acting administrator differs from the dashboard owner
Unexpected changes to widget layout, content, or visibility on administrator dashboards without a corresponding legitimate session
Repeated dashboard API requests originating from read-only administrator sessions

Detection Strategies

Enable and forward FortiWeb administrative audit logs to a central SIEM, then correlate the actor identity with the dashboard owner on every widget operation
Alert on dashboard write operations performed by accounts provisioned with read-only roles
Baseline normal dashboard change frequency per administrator and flag deviations

Monitoring Recommendations

Ingest FortiWeb management-plane logs into a centralized log platform for cross-user correlation
Review administrator role assignments quarterly and remove unused read-only accounts
Monitor authentication events for administrator accounts accessing the management interface from unusual source addresses

How to Mitigate CVE-2024-46671

Immediate Actions Required

Upgrade FortiWeb to a fixed version as identified in Fortinet advisory FG-IR-24-184
Audit all administrator accounts and remove any read-only or unused accounts that are not strictly required
Restrict access to the FortiWeb management interface to trusted management networks only

Patch Information

Fortinet has published fixed builds through advisory FG-IR-24-184. Upgrade paths cover the FortiWeb 7.0.x, 7.2.x, 7.4.x, and 7.6.x branches. Refer to the vendor advisory for exact fixed version numbers matching your deployed branch.

Workarounds

Limit administrator interface exposure through trusted-host restrictions on each administrator account
Enforce multi-factor authentication on all FortiWeb administrator accounts to reduce credential-based access
Segment the management network so that only authorized operators can reach the FortiWeb GUI or API

bash

# Configuration example: restrict administrator access using trusted hosts
config system admin
  edit "readonly_auditor"
    set trusthost1 10.0.0.0 255.255.255.0
    set accprofile "prof_readonly"
  next
end