CVE-2026-81559: Medium severity vulnerability
Published Nov 12, 2026
·Updated
A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.
Event History
Nov 12, 2026
CVE Published
via MITRE·03:38 AM
Data Sourced
via MITRE·03:38 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote user who is already authenticated to DSM and has the required low-level privileges can exploit it. The available data does not indicate that unauthenticated users can do so.
2
What impact can exploitation have?
An attacker can write specific files through the TaskScheduler API. The reported impact is limited to integrity; no confidentiality or availability impact is indicated.
3
Which DSM versions need remediation?
DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected. Update to the applicable fixed release or later.