CVE-2026-81558: Medium severity vulnerability
Published Nov 12, 2026
·Updated
A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.
Event History
Nov 12, 2026
CVE Published
via MITRE·03:38 AM
Data Sourced
via MITRE·03:38 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
A remote user who is already authenticated to DSM can exploit it. The provided information does not indicate that unauthenticated users are affected.
2
Which DSM versions are affected?
DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected.
3
What can a successful attacker do?
An authenticated remote attacker can write specific files through the SocketIo API. The available information does not identify which files can be written or whether this enables further impact.