CVE-2026-74857

Synology DiskStation Manager arbitrary file read and write in Auth API

high · 8.8

Fix listed

Synology DiskStation Manager

Published Nov 12, 2026, 03:32 UTC

Description

A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.

Reported fixed versions

7.4.1-90080-1, 7.3.2-86009-5

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.