Administrator password disclosure through event logs

Information disclosure in Fortinet FortiWeb allows attackers to read encrypted administrator passwords through the Log Access Event page. The page displays encrypted password fields belonging to other administrators without enforcing equivalent credential access. An authenticated administrator with Log & Report permissions can retrieve the encrypted credential material, but public records do not establish plaintext recovery or account takeover.