---
id: "CVE-2020-2506"
kind: "vulnerability"
aliases: ["CVE-2020-2506"]
title: "QNAP Systems Helpdesk: QNAP Helpdesk Improper Access Control Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.01982
exploited: true
status: "open"
category: "vendor"
products: [{"name": "QNAP Systems Helpdesk", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "helpdesk", "qnap", "vendor"]
not_affected_if: ["unknown"]
published_at: "2021-02-03T16:15:13+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-2506", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-2506", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2506", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# QNAP Systems Helpdesk: QNAP Helpdesk Improper Access Control Vulnerability

QNAP Helpdesk, a vendor support ticketing product, has an improper access control flaw. An attacker could gain privileges or read sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:QNAP Systems Helpdesk affected ? fixed ?

## Fix

Apply updates per vendor instructions (CISA KEV required action); specific fixed version unknown.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-2506
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-2506
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-2506

## From the sources

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_