CVE-2026-13672: High severity vulnerability

Published Nov 12, 2026

Updated

An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:31 AM

Data Sourced

via MITRE·03:31 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to DSM. No user interaction is required, and the attack complexity is low.

What impact can successful exploitation have?

An authenticated attacker can read or write arbitrary files and cause denial-of-service conditions, affecting confidentiality, integrity, and availability.

Which DSM versions need to be updated?

DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected. Update to the applicable fixed version or later.

CVE-2026-13672: High severity vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can successful exploitation have?

Which DSM versions need to be updated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can successful exploitation have?

Which DSM versions need to be updated?