CVE-2024-46671: Fortinet FortiWeb Auth Bypass Vulnerability

CVE-2024-46671 Overview

CVE-2024-46671 is an Incorrect User Management vulnerability [CWE-286] affecting Fortinet FortiWeb. The flaw resides in the widgets dashboard component and allows an authenticated attacker holding at least read-only administrator permissions to perform operations on dashboards belonging to other administrators. Attackers exploit the issue by sending crafted HTTP requests to the management interface. The vulnerability affects FortiWeb versions 7.6.2 and below, 7.4.6 and below, 7.2.10 and below, and 7.0.11 and below. Fortinet published the advisory as FG-IR-24-184.

Critical Impact
A low-privileged administrator can manipulate the dashboards of higher-privileged administrators, undermining role-based separation on FortiWeb management consoles.

Affected Products

Fortinet FortiWeb 7.6.0 through 7.6.2
Fortinet FortiWeb 7.4.0 through 7.4.6
Fortinet FortiWeb 7.2.0 through 7.2.10 and 7.0.0 through 7.0.11

Discovery Timeline

2025-04-08 - CVE-2024-46671 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46671

Vulnerability Analysis

The vulnerability stems from improper enforcement of user separation within the FortiWeb administrative dashboard. FortiWeb assigns each administrator a personalized dashboard workspace containing widgets. The dashboard handler fails to verify that the requesting administrator owns the target dashboard resource before executing the requested operation. As a result, any authenticated administrator, including accounts scoped to read-only, can issue requests that alter dashboards owned by other administrators.

The underlying weakness is categorized under CWE-286: Incorrect User Management. Fortinet documents the issue in the Fortinet Security Advisory FG-IR-24-184.

Root Cause

The dashboard widget management endpoints trust the administrator identifier or dashboard identifier supplied in the request rather than binding operations to the authenticated session owner. Read-only role checks apply to configuration surfaces but do not extend to dashboard widget objects, which are treated as user-scoped preferences rather than protected resources.

Attack Vector

Exploitation requires network access to the FortiWeb management interface and valid credentials for any administrator account, including a read-only account. The attacker crafts HTTP requests that reference dashboard objects belonging to other administrators. The management API processes the operation because it does not correlate the target dashboard owner with the authenticated principal. Successful abuse permits modification of widget contents, which can mislead senior administrators or hide indicators of malicious activity on their monitoring surface.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-46671

Indicators of Compromise

Unexpected changes to administrator dashboard widgets, layouts, or reported metrics without a matching audit entry from the dashboard owner.
HTTP requests to FortiWeb dashboard widget endpoints where the referenced administrator identifier does not match the authenticated session user.
Administrative sessions from read-only accounts issuing write-style requests against /dashboard or widget management paths.

Detection Strategies

Enable and forward FortiWeb administrative audit logs to a central logging platform and alert on dashboard modifications performed by non-owner accounts.
Correlate GUI activity logs with the account role to flag read-only administrators generating dashboard state changes.
Baseline expected administrator activity and alert on deviations, particularly from service or auditor accounts that should not modify UI state.

Monitoring Recommendations

Restrict management-plane access to a dedicated administration network and log all authentication events against the FortiWeb GUI.
Monitor for creation of new administrator accounts or elevation of role permissions preceding dashboard anomalies.
Review Fortinet PSIRT advisories on a recurring schedule and track patch status per FortiWeb instance.

How to Mitigate CVE-2024-46671

Immediate Actions Required

Upgrade FortiWeb to a fixed release as listed in FG-IR-24-184: version 7.6.3 or later, 7.4.7 or later, 7.2.11 or later, or 7.0.11 or later per the vendor guidance.
Audit all administrator accounts and remove unnecessary read-only or delegated accounts that do not require dashboard access.
Enforce multi-factor authentication for every administrative account on the FortiWeb GUI.

Patch Information

Fortinet released fixed builds for each supported FortiWeb branch. Refer to the Fortinet Security Advisory FG-IR-24-184 for the authoritative version matrix and upgrade paths. Apply the patch through the standard FortiWeb firmware upgrade workflow and validate configuration integrity after reboot.

Workarounds

Limit administrative interface exposure to trusted management networks using trusthost restrictions on each administrator profile.
Reduce the number of accounts with any administrative role, including read-only, until the patch is deployed.
Review administrator activity logs frequently and treat any dashboard changes attributed to accounts other than the dashboard owner as suspicious.

bash

# Configuration example: restrict admin logins to a management subnet
config system admin
  edit "readonly_auditor"
    set trusthost1 10.10.20.0 255.255.255.0
    set accprofile "prof_readonly"
  next
end