{"id":"CVE-2026-19414","kind":"vulnerability","aliases":["CVE-2026-19414"],"related":[],"title":"Synology DSM: Promotion API lets logged-in users write specific files","description":"A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.","summary":"The Promotion API in Synology DiskStation Manager lacks an authorization check, so a remote user with a valid account can write certain files on the NAS. The sources do not say what files or what further access follows from that write.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["no-remote-accounts","patched-dsm"],"how_to_check":"- Open DSM and note the version under Control Panel > Info Center; compare against `7.3.2-86009-5` and `7.4.1-90080-1`\n- Check whether any DSM user accounts beyond administrators can log in remotely","fix":"- Move DSM 7.3 installs to `7.3.2-86009-5` or later\n- Move DSM 7.4 installs to `7.4.1-90080-1` or later","status":"open","published_at":"2026-11-12T04:17:19+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","triaged_at":"2026-11-12T04:48:06+00:00","updated_at":"2026-11-12T04:48:06+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T04:48:06Z","model":"claude-haiku-5-5","output":{"fix":"- Move DSM 7.3 installs to `7.3.2-86009-5` or later\n- Move DSM 7.4 installs to `7.4.1-90080-1` or later","reach":"network","title":"Synology DSM: Promotion API lets logged-in users write specific files","impact":"medium","summary":"The Promotion API in Synology DiskStation Manager lacks an authorization check, so a remote user with a valid account can write certain files on the NAS. The sources do not say what files or what further access follows from that write.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user writes files they should not reach","analyst_note":"","how_to_check":"- Open DSM and note the version under Control Panel > Info Center; compare against `7.3.2-86009-5` and `7.4.1-90080-1`\n- Check whether any DSM user accounts beyond administrators can log in remotely","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-dsm","no-remote-accounts"],"who_is_affected":"DiskStation Manager versions before 7.3.2-86009-5 and 7.4.1-90080-1 are affected, and the attacker needs a valid account on the device. Systems where only administrators can log in remotely and that are kept on the patched builds are less exposed. The sources do not describe the default configuration of the Promotion API.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4529,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':87C '-19414':15A,18A '-2026':14A,17A '-5':83C '-86009':82C '-90080':86C '7.3.2':81C '7.4.1':85C 'access':62B 'account':44B 'allow':88C 'api':4A,28B,74C 'authent':90C 'author':35B,69C 'certain':47B 'check':36B 'cve':13A,16A 'diskstat':31B,77C 'dsm':2A,19B,79C 'file':12A,48B,58B,95C 'follow':63B 'host':24B 'infrastructur':20B 'lack':33B 'let':5A 'log':7A 'logged-in':6A 'manag':32B,78C 'miss':68C 'nas':21B,51B 'promot':3A,27B,73C 'remot':39B,89C 'say':56B 'self':23B 'self-host':22B 'sourc':53B 'specif':11A,94C 'synolog':1A,25B,30B,76C 'user':9A,40B,91C 'valid':43B 'vulner':70C 'write':10A,46B,66B,93C","nicknames":[],"mitigations":[],"who_affected":"DiskStation Manager versions before 7.3.2-86009-5 and 7.4.1-90080-1 are affected, and the attacker needs a valid account on the device. Systems where only administrators can log in remotely and that are kept on the patched builds are less exposed. The sources do not describe the default configuration of the Promotion API.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-19414':15A,18A '-2026':14A,17A 'api':4A 'cve':13A,16A 'dsm':2A 'file':12A 'let':5A 'log':7A 'logged-in':6A 'promot':3A 'specif':11A 'synolog':1A 'user':9A 'write':10A","search_b":"'access':62B 'account':44B 'api':28B 'author':35B 'certain':47B 'check':36B 'diskstat':31B 'dsm':19B 'file':48B,58B 'follow':63B 'host':24B 'infrastructur':20B 'lack':33B 'manag':32B 'nas':21B,51B 'promot':27B 'remot':39B 'say':56B 'self':23B 'self-host':22B 'sourc':53B 'synolog':25B,30B 'user':40B 'valid':43B 'write':46B,66B","search_c":"'-1':87C '-5':83C '-86009':82C '-90080':86C '7.3.2':81C '7.4.1':85C 'allow':88C 'api':74C 'authent':90C 'author':69C 'diskstat':77C 'dsm':79C 'file':95C 'manag':78C 'miss':68C 'promot':73C 'remot':89C 'specif':94C 'synolog':76C 'user':91C 'vulner':70C 'write':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19414","severity":null,"published_at":"2026-11-12T04:17:19+00:00","modified_at":"2026-11-12T04:17:19+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","fetched_at":"2026-11-12T04:47:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}