{"id":"CVE-2026-19833","kind":"vulnerability","aliases":["CVE-2026-19833"],"related":[],"title":"Synology DSM: ACL API lets logged-in users read or write files","description":"A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.","summary":"Synology DiskStation Manager has a missing authorization check in its ACL API. A remote user who already has an account can read or write specific files they should not reach.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["no-remote-accounts","patched-dsm"],"how_to_check":"- Check the DSM version under Control Panel > Info Center; `7.3.2-86009-5` or `7.4.1-90080-1` and later are patched","fix":"- DSM before `7.3.2-86009-5` on the 7.3 branch\n- DSM before `7.4.1-90080-1` on the 7.4 branch","status":"open","published_at":"2026-11-12T04:17:19+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","triaged_at":"2026-11-12T04:47:56+00:00","updated_at":"2026-11-12T04:47:56+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T04:47:56Z","model":"claude-haiku-5-5","output":{"fix":"- DSM before `7.3.2-86009-5` on the 7.3 branch\n- DSM before `7.4.1-90080-1` on the 7.4 branch","reach":"network","title":"Synology DSM: ACL API lets logged-in users read or write files","impact":"medium","summary":"Synology DiskStation Manager has a missing authorization check in its ACL API. A remote user who already has an account can read or write specific files they should not reach.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","self-hosted","nas"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or writes files outside their access","analyst_note":"","how_to_check":"- Check the DSM version under Control Panel > Info Center; `7.3.2-86009-5` or `7.4.1-90080-1` and later are patched\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-dsm","no-remote-accounts"],"who_is_affected":"Only DSM installs that allow remote login by accounts that are not fully trusted are at real risk. Admins should look at which accounts can sign in remotely and update DSM on both the 7.3 and 7.4 branches.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4542,"output_tokens":482,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':77C '-19833':16A,19A '-2026':15A,18A '-5':73C '-86009':72C '-90080':76C '7.3.2':71C '7.4.1':75C 'account':46B 'acl':3A,37B,63C 'allow':78C 'alreadi':43B 'api':4A,38B,64C 'authent':80C 'author':33B,59C 'check':34B 'cve':14A,17A 'diskstat':28B,67C 'dsm':2A,20B,69C 'file':13A,52B,87C 'host':25B 'infrastructur':21B 'let':5A 'log':7A 'logged-in':6A 'manag':29B,68C 'miss':32B,58C 'nas':22B 'reach':56B 'read':10A,48B,83C 'remot':40B,79C 'self':24B 'self-host':23B 'specif':51B,86C 'synolog':1A,26B,27B,66C 'user':9A,41B,81C 'vulner':60C 'write':12A,50B,85C","nicknames":[],"mitigations":[],"who_affected":"Only DSM installs that allow remote login by accounts that are not fully trusted are at real risk. Admins should look at which accounts can sign in remotely and update DSM on both the 7.3 and 7.4 branches.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-19833':16A,19A '-2026':15A,18A 'acl':3A 'api':4A 'cve':14A,17A 'dsm':2A 'file':13A 'let':5A 'log':7A 'logged-in':6A 'read':10A 'synolog':1A 'user':9A 'write':12A","search_b":"'account':46B 'acl':37B 'alreadi':43B 'api':38B 'author':33B 'check':34B 'diskstat':28B 'dsm':20B 'file':52B 'host':25B 'infrastructur':21B 'manag':29B 'miss':32B 'nas':22B 'reach':56B 'read':48B 'remot':40B 'self':24B 'self-host':23B 'specif':51B 'synolog':26B,27B 'user':41B 'write':50B","search_c":"'-1':77C '-5':73C '-86009':72C '-90080':76C '7.3.2':71C '7.4.1':75C 'acl':63C 'allow':78C 'api':64C 'authent':80C 'author':59C 'diskstat':67C 'dsm':69C 'file':87C 'manag':68C 'miss':58C 'read':83C 'remot':79C 'specif':86C 'synolog':66C 'user':81C 'vulner':60C 'write':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19833","severity":null,"published_at":"2026-11-12T04:17:19+00:00","modified_at":"2026-11-12T04:17:19+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","fetched_at":"2026-11-12T04:47:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}