CVE-2013-4604: Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which all...

Security readout for executives and security teams

A FortiGate running FortiOS before 5.0.3 could let a logged-in Guest user manage records belonging to other users. That means a low-privilege account may be able to read, change, or delete user records outside its intended scope. The public bundle does not provide CVSS scoring or active exploitation evidence. Exposure is most likely limited to legacy FortiGate deployments still running FortiOS earlier than 5.0.3, especially where Guest-role accounts exist or are externally reachable through management or guest workflows. Treat this as a targeted legacy-device risk. It is not supported as actively exploited, but organizations still running FortiOS before 5.0.3 should prioritize upgrade or isolation because user records can be altered by low-privilege authenticated users. Mitigation focus: Upgrade affected FortiOS deployments to 5.0.3 or later per vendor guidance.; Review Fortinet advisory FGA-2013-20 for product-specific remediation details.; Disable or tightly limit Guest-role accounts where no longer needed..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.