{"id":"CVE-2026-13672","kind":"vulnerability","aliases":["CVE-2026-13672"],"related":[],"title":"Synology DSM: SSO login flaw lets users read or write arbitrary files","description":"An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.","summary":"An authorization bypass in the SSOAuth component of Synology DiskStation Manager lets a logged-in user read or write files they should not reach, and cause denial of service. The flaw is in how user-controlled keys are handled during SSO authentication.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["fixed-version","no-untrusted-accounts"],"how_to_check":"- Check the DSM version in Control Panel > Info Center; compare it against `7.3.2-86009-5` and `7.4.1-90080-1`\n- Confirm whether SSO single sign-on (SSOAuth) is enabled in the DSM configuration","fix":"- DSM 7.3.x: move to `7.3.2-86009-5` or later\n- DSM 7.4.x: move to `7.4.1-90080-1` or later","status":"open","published_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","triaged_at":"2026-11-12T04:47:36+00:00","updated_at":"2026-11-12T04:47:36+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T04:47:36Z","model":"claude-haiku-5-5","output":{"fix":"- DSM 7.3.x: move to `7.3.2-86009-5` or later\n- DSM 7.4.x: move to `7.4.1-90080-1` or later","reach":"network","title":"Synology DSM: SSO login flaw lets users read or write arbitrary files","impact":"high","summary":"An authorization bypass in the SSOAuth component of Synology DiskStation Manager lets a logged-in user read or write files they should not reach, and cause denial of service. The flaw is in how user-controlled keys are handled during SSO authentication.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or writes arbitrary files on the NAS","analyst_note":"Confirm from Synology's security advisory whether SSOAuth is enabled by default and the exact affected version ranges.","how_to_check":"- Check the DSM version in Control Panel > Info Center; compare it against `7.3.2-86009-5` and `7.4.1-90080-1`\n- Confirm whether SSO single sign-on (SSOAuth) is enabled in the DSM configuration","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-version","no-untrusted-accounts"],"who_is_affected":"DiskStation Manager installations on versions before `7.3.2-86009-5` (7.3 branch) or before `7.4.1-90080-1` (7.4 branch). Exposure requires an authenticated DSM account; unknown whether SSOAuth must be enabled for the flaw to be reachable. Systems that are already on the fixed builds, or that have no user accounts that could be malicious, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4558,"output_tokens":672,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':94C '-13672':15A,18A '-2026':14A,17A '-5':90C '-86009':89C '-90080':93C '7.3.2':88C '7.4.1':92C 'allow':95C 'arbitrari':11A,103C 'attack':111C 'authent':69B,97C 'author':27B,71C 'bypass':28B,72C 'caus':52B 'compon':32B 'conduct':106C 'control':63B,76C 'cve':13A,16A 'denial':53B,108C 'denial-of-servic':107C 'diskstat':35B,84C 'dsm':2A,19B,86C 'file':12A,46B,104C 'flaw':5A,57B 'handl':66B 'host':24B 'infrastructur':20B 'key':64B,77C 'let':6A,37B 'log':40B 'logged-in':39B 'login':4A 'manag':36B,85C 'nas':21B 'reach':50B 'read':8A,43B,100C 'remot':96C 'self':23B 'self-host':22B 'servic':55B,110C 'sso':3A,68B 'ssoauth':31B,81C 'synolog':1A,25B,34B,83C 'user':7A,42B,62B,75C,98C 'user-control':61B,74C 'vulner':78C 'write':10A,45B,102C","nicknames":[],"mitigations":[],"who_affected":"DiskStation Manager installations on versions before `7.3.2-86009-5` (7.3 branch) or before `7.4.1-90080-1` (7.4 branch). Exposure requires an authenticated DSM account; unknown whether SSOAuth must be enabled for the flaw to be reachable. Systems that are already on the fixed builds, or that have no user accounts that could be malicious, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","high","infrastructure","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-13672':15A,18A '-2026':14A,17A 'arbitrari':11A 'cve':13A,16A 'dsm':2A 'file':12A 'flaw':5A 'let':6A 'login':4A 'read':8A 'sso':3A 'synolog':1A 'user':7A 'write':10A","search_b":"'authent':69B 'author':27B 'bypass':28B 'caus':52B 'compon':32B 'control':63B 'denial':53B 'diskstat':35B 'dsm':19B 'file':46B 'flaw':57B 'handl':66B 'host':24B 'infrastructur':20B 'key':64B 'let':37B 'log':40B 'logged-in':39B 'manag':36B 'nas':21B 'reach':50B 'read':43B 'self':23B 'self-host':22B 'servic':55B 'sso':68B 'ssoauth':31B 'synolog':25B,34B 'user':42B,62B 'user-control':61B 'write':45B","search_c":"'-1':94C '-5':90C '-86009':89C '-90080':93C '7.3.2':88C '7.4.1':92C 'allow':95C 'arbitrari':103C 'attack':111C 'authent':97C 'author':71C 'bypass':72C 'conduct':106C 'control':76C 'denial':108C 'denial-of-servic':107C 'diskstat':84C 'dsm':86C 'file':104C 'key':77C 'manag':85C 'read':100C 'remot':96C 'servic':110C 'ssoauth':81C 'synolog':83C 'user':75C,98C 'user-control':74C 'vulner':78C 'write':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13672","severity":null,"published_at":"2026-11-12T04:17:18+00:00","modified_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","fetched_at":"2026-11-12T04:47:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}