Privilege escalation via unverified configuration backup

Unverified password change in Fortinet FortiManager and FortiAnalyzer allows local users to alter administrator passwords via a backup. The device configuration backup workflow accepts changed administrator-password data from a read-write user without verifying authority over the target account. A read-write administrative session and local access are required; successful use grants control over more privileged accounts.