CVE-2026-81559 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Synology DiskStation Manager has a missing authorization check in its TaskScheduler API. A remote user with a valid account can write specific files on the NAS.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of Synology DSM systems running a version before 7.3.2-86009-5 or 7.4.1-90080-1 are exposed, provided an attacker holds a valid user account on the NAS. Systems on fixed versions or without remote user accounts are not affected by this description.
Not affected if fixed-version, no-remote-accounts
Who cares dsm, nas, self-hosted, synology
cat /etc/VERSION over SSH) and compare it with the fixed releases.7.3.2-86009-5 or later on the 7.3 branch, or 7.4.1-90080-1 or later on the 7.4 branch.A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.