{"id":"CVE-2026-76954","kind":"vulnerability","aliases":["CVE-2026-76954"],"related":[],"title":"Synology DSM: SQL injection in Auth API lets remote attackers read and write files","description":"An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.","summary":"Synology DiskStation Manager has an SQL injection flaw in its Auth API that lets remote attackers read or write arbitrary files and cause denial of service. The NVD score is 9.8 critical.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Synology DiskStation Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dsm","nas","self-hosted","synology","vendor"],"not_affected_if":["dsm-already-patched"],"how_to_check":"- Open DSM and check the installed version under Control Panel > Info Center; compare it with the fixed versions listed below.","fix":"- DSM `7.2.1-69057-13` or later on the 7.2.1 branch\n- DSM `7.2.2-72806-10` or later on the 7.2.2 branch\n- DSM `7.3.2-86009-5` or later on the 7.3.2 branch\n- DSM `7.4.1-90080-1` or later on the 7.4.1 branch","status":"open","published_at":"2026-11-12T04:17:20+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","triaged_at":"2026-11-12T04:47:36+00:00","updated_at":"2026-11-12T04:47:36+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-12T04:47:36Z","model":"claude-haiku-5-5","output":{"fix":"- DSM `7.2.1-69057-13` or later on the 7.2.1 branch\n- DSM `7.2.2-72806-10` or later on the 7.2.2 branch\n- DSM `7.3.2-86009-5` or later on the 7.3.2 branch\n- DSM `7.4.1-90080-1` or later on the 7.4.1 branch","reach":"network","title":"Synology DSM: SQL injection in Auth API lets remote attackers read and write files","impact":"high","summary":"Synology DiskStation Manager has an SQL injection flaw in its Auth API that lets remote attackers read or write arbitrary files and cause denial of service. The NVD score is 9.8 critical.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attackers read or write arbitrary files on the NAS","analyst_note":"Confirm whether the Auth API flaw is reachable unauthenticated from the internet and find Synology's advisory for the exact exposure.","how_to_check":"- Open DSM and check the installed version under Control Panel > Info Center; compare it with the fixed versions listed below.\n- unknown for other checks: the sources do not say which request or setting exposes the Auth API.","plain_action":"","product_name":"Synology DiskStation Manager","needs_analyst":true,"not_affected_if":["dsm-already-patched"],"who_is_affected":"Any Synology DiskStation Manager install on an affected version is in scope, since the Auth API is part of the login path. The sources do not say whether the flaw needs a login first or whether it is reachable from the internet by default. Teams running Synology NAS devices on their network should treat it as exposed until the version is confirmed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000802,"input_tokens":4577,"output_tokens":689,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1':97C '-10':90C '-13':87C '-2026':16A,19A '-5':93C '-69057':86C '-72806':89C '-76954':17A,20A '-86009':92C '-90080':96C '7.2.1':85C '7.2.2':88C '7.3.2':91C '7.4.1':95C '9.8':61B 'allow':98C 'api':7A,42B,78C 'arbitrari':50B,105C 'attack':10A,46B,100C,113C 'auth':6A,41B,77C 'caus':53B 'command':73C 'conduct':108C 'critic':62B 'cve':15A,18A 'denial':54B,110C 'denial-of-servic':109C 'diskstat':32B,81C 'diskstation':22A 'dsm':2A,24B,83C 'element':68C 'file':14A,51B,106C 'flaw':38B 'host':28B 'improp':64C 'inject':4A,37B 'let':8A,44B 'manag':33B,82C 'manager':23A 'nas':25B 'neutral':65C 'nvd':58B 'read':11A,47B,102C 'remot':9A,45B,99C 'score':59B 'self':27B 'self-host':26B 'servic':56B,112C 'special':67C 'sql':3A,36B,72C 'synolog':1A,29B,31B,80C 'synology':21A 'use':69C 'vendor':30B 'vulner':74C 'write':13A,49B,104C","nicknames":[],"mitigations":[],"who_affected":"Any Synology DiskStation Manager install on an affected version is in scope, since the Auth API is part of the login path. The sources do not say whether the flaw needs a login first or whether it is reachable from the internet by default. Teams running Synology NAS devices on their network should treat it as exposed until the version is confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["diskstationmanager","synologydiskstationmanager"],"ptokens":["diskstation","manager","synology"],"labels":["critical","dsm","nas","selfhosted","synology","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-76954':17A,20A 'api':7A 'attack':10A 'auth':6A 'cve':15A,18A 'diskstation':22A 'dsm':2A 'file':14A 'inject':4A 'let':8A 'manager':23A 'read':11A 'remot':9A 'sql':3A 'synolog':1A 'synology':21A 'write':13A","search_b":"'9.8':61B 'api':42B 'arbitrari':50B 'attack':46B 'auth':41B 'caus':53B 'critic':62B 'denial':54B 'diskstat':32B 'dsm':24B 'file':51B 'flaw':38B 'host':28B 'inject':37B 'let':44B 'manag':33B 'nas':25B 'nvd':58B 'read':47B 'remot':45B 'score':59B 'self':27B 'self-host':26B 'servic':56B 'sql':36B 'synolog':29B,31B 'vendor':30B 'write':49B","search_c":"'-1':97C '-10':90C '-13':87C '-5':93C '-69057':86C '-72806':89C '-86009':92C '-90080':96C '7.2.1':85C '7.2.2':88C '7.3.2':91C '7.4.1':95C 'allow':98C 'api':78C 'arbitrari':105C 'attack':100C,113C 'auth':77C 'command':73C 'conduct':108C 'denial':110C 'denial-of-servic':109C 'diskstat':81C 'dsm':83C 'element':68C 'file':106C 'improp':64C 'manag':82C 'neutral':65C 'read':102C 'remot':99C 'servic':112C 'special':67C 'sql':72C 'synolog':80C 'use':69C 'vulner':74C 'write':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76954","severity":null,"published_at":"2026-11-12T04:17:20+00:00","modified_at":"2026-11-12T04:17:20+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","fetched_at":"2026-11-12T04:47:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}