CVE-2026-40537: SSRF
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to authenticate remotely to the affected DSM system. The available data does not indicate that unauthenticated users can exploit it.
What is the impact of successful exploitation?
Successful exploitation allows an authenticated remote user to obtain non-sensitive information through server-side request forgery. The provided CVSS vector indicates low confidentiality impact and no integrity or availability impact.
Which DSM releases need to be remediated?
DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 are affected. Update to the applicable listed release or a later version.