CVE-2026-19414: Medium severity vulnerability

Published Nov 12, 2026

Updated

A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:37 AM

Data Sourced

via MITRE·03:37 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote user who is already authenticated to DSM can exploit it. The provided data does not indicate that unauthenticated users are affected.

What access does an attacker need, and what is the impact?

The attacker needs low-level authenticated privileges and can write specific files through the Promotion API. The supplied severity vector indicates integrity impact only, with no stated confidentiality or availability impact.

Which DSM versions need remediation?

DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected. Update to the applicable fixed build or later.

CVE-2026-19414: Medium severity vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need, and what is the impact?

Which DSM versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need, and what is the impact?

Which DSM versions need remediation?