FORTINET Security Advisory
Published Date: 🗓️ : September 8, 2026
Advisory Summary
Title: ⛔ Broken Access control on Websocket streams (FortiSOAR)
—
- Subscribe to WebSocket streams/topics
- Inject/broadcast messages into the stream via crafted WebSocket requests
✅ CVSSv3: 4.9 (Moderate)
Revised: 2026-09-08
—
- Confidentiality exposure (viewing unauthorized event/stream data)
- Integrity attacks (sending spoofed or malicious broadcast messages)
- Operational disruption (triggering workflows/alerts with unauthorized messages, depending on integrations and downstream automations)
For SOC operations and SOAR-driven response chains, unauthorized stream access can have outsize business impact, especially where event ingestion directly drives case creation, automation, or escalation.
—
### 🚨 Practical risk scenario
An attacker who already has any valid FortiSOAR authentication (even with no assigned permissions) could attempt to:
1. Connect to the WebSocket endpoint
2. Enumerate/subscribe to streams and topics
3. Push crafted broadcast payloads to influence what other components receive
—
- Verify whether your FortiSOAR version is affected (use the PSIRT advisory).
- Review accounts that can authenticate to FortiSOAR and confirm least-privilege is strictly enforced.
- Restrict network access to FortiSOAR WebSocket endpoints (IP allowlisting / segmentation).
- Tighten authentication/authorization policies and ensure role mappings truly prevent stream subscription for “zero permission” users.
- Monitor WebSocket traffic patterns for unusual subscription attempts and broadcast attempts from low-privilege accounts.
- Apply the vendor-released fix from the PSIRT advisory as the primary remediation path.
—
- Topic/stream routing
- Message publishing/broadcast handlers
- WebSocket handshake authorization and session-to-permission mapping
Consider testing adjacent endpoints for similar access control enforcement issues.
—
### ✅ Reference
Reference: Vendor Advisory