{"id":"CVE-2026-77738","kind":"vulnerability","aliases":["CVE-2026-77738"],"related":[],"title":"Synology DSM: Credential API lets logged-in users read specific files","description":"A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files.","summary":"A server-side request forgery flaw in the Credential API of Synology DiskStation Manager lets a signed-in user make the server fetch resources and read specific files. The attacker needs a valid account on the NAS.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["auth-required","no-untrusted-accounts"],"how_to_check":"- Check the DSM version under Control Panel > Info Center; compare it against `7.3.2-86009-5` and `7.4.1-90080-1`.\n- Confirm whether untrusted users have DSM accounts on the NAS.","fix":"- Move DSM 7.3 branch to `7.3.2-86009-5` or later.\n- Move DSM 7.4 branch to `7.4.1-90080-1` or later.","status":"open","published_at":"2026-11-12T04:17:20+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","triaged_at":"2026-11-12T04:48:04+00:00","updated_at":"2026-11-12T04:48:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T04:48:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move DSM 7.3 branch to `7.3.2-86009-5` or later.\n- Move DSM 7.4 branch to `7.4.1-90080-1` or later.","reach":"network","title":"Synology DSM: Credential API lets logged-in users read specific files","impact":"low","summary":"A server-side request forgery flaw in the Credential API of Synology DiskStation Manager lets a signed-in user make the server fetch resources and read specific files. The attacker needs a valid account on the NAS.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user reads specific files on the NAS.","analyst_note":"","how_to_check":"- Check the DSM version under Control Panel > Info Center; compare it against `7.3.2-86009-5` and `7.4.1-90080-1`.\n- Confirm whether untrusted users have DSM accounts on the NAS.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","no-untrusted-accounts"],"who_is_affected":"Only DiskStation Manager versions before `7.3.2-86009-5` and `7.4.1-90080-1` are named by the sources. The attacker needs an authenticated DSM account, so systems where only trusted staff have logins carry less risk. Teams running Synology NAS devices with shared or external user accounts should prioritise updating.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4531,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':88C '-2026':14A,17A '-5':84C '-77738':15A,18A '-86009':83C '-90080':87C '7.3.2':82C '7.4.1':86C 'account':61B 'allow':89C 'api':4A,36B,75C 'attack':57B 'authent':91C 'credenti':3A,35B,74C 'cve':13A,16A 'diskstat':39B,78C 'dsm':2A,19B,80C 'fetch':50B 'file':12A,55B,96C 'flaw':32B 'forgeri':31B,70C 'host':24B 'infrastructur':20B 'let':5A,41B 'log':7A 'logged-in':6A 'make':47B 'manag':40B,79C 'nas':21B,64B 'need':58B 'read':10A,53B,94C 'remot':90C 'request':30B,69C 'resourc':51B 'self':23B 'self-host':22B 'server':28B,49B,67C 'server-sid':27B,66C 'side':29B,68C 'sign':44B 'signed-in':43B 'specif':11A,54B,95C 'synolog':1A,25B,38B,77C 'user':9A,46B,92C 'valid':60B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Only DiskStation Manager versions before `7.3.2-86009-5` and `7.4.1-90080-1` are named by the sources. The attacker needs an authenticated DSM account, so systems where only trusted staff have logins carry less risk. Teams running Synology NAS devices with shared or external user accounts should prioritise updating.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-2026':14A,17A '-77738':15A,18A 'api':4A 'credenti':3A 'cve':13A,16A 'dsm':2A 'file':12A 'let':5A 'log':7A 'logged-in':6A 'read':10A 'specif':11A 'synolog':1A 'user':9A","search_b":"'account':61B 'api':36B 'attack':57B 'credenti':35B 'diskstat':39B 'dsm':19B 'fetch':50B 'file':55B 'flaw':32B 'forgeri':31B 'host':24B 'infrastructur':20B 'let':41B 'make':47B 'manag':40B 'nas':21B,64B 'need':58B 'read':53B 'request':30B 'resourc':51B 'self':23B 'self-host':22B 'server':28B,49B 'server-sid':27B 'side':29B 'sign':44B 'signed-in':43B 'specif':54B 'synolog':25B,38B 'user':46B 'valid':60B","search_c":"'-1':88C '-5':84C '-86009':83C '-90080':87C '7.3.2':82C '7.4.1':86C 'allow':89C 'api':75C 'authent':91C 'credenti':74C 'diskstat':78C 'dsm':80C 'file':96C 'forgeri':70C 'manag':79C 'read':94C 'remot':90C 'request':69C 'server':67C 'server-sid':66C 'side':68C 'specif':95C 'synolog':77C 'user':92C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77738","severity":null,"published_at":"2026-11-12T04:17:20+00:00","modified_at":"2026-11-12T04:17:20+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","fetched_at":"2026-11-12T04:47:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}