CVE-2026-81558 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Synology DiskStation Manager has a missing authorization check in its SocketIO API. A remote user who already has an account can write specific files they should not be able to change.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Synology NAS devices running DSM before 7.3.2-86009-5 or 7.4.1-90080-1 are exposed, and only to users who already have a valid DSM account. Systems on managed or non-Synology hardware are not affected.
Not affected if patched-dsm, unauthenticated-only-access
Who cares dsm, nas, self-hosted, synology
7.3.2-86009-5 or later on the 7.3 branch7.4.1-90080-1 or later on the 7.4 branchA missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.