{"id":"CVE-2026-81559","kind":"vulnerability","aliases":["CVE-2026-81559"],"related":[],"title":"Synology DSM: TaskScheduler API lets authenticated users write files","description":"A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.","summary":"Synology DiskStation Manager has a missing authorization check in its TaskScheduler API. A remote user with a valid account can write specific files on the NAS.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["fixed-version","no-remote-accounts"],"how_to_check":"- Check the installed DSM version in Control Panel > Info Center (or run `cat /etc/VERSION` over SSH) and compare it with the fixed releases.","fix":"- Move DSM to `7.3.2-86009-5` or later on the 7.3 branch, or `7.4.1-90080-1` or later on the 7.4 branch.","status":"open","published_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","triaged_at":"2026-11-12T04:48:02+00:00","updated_at":"2026-11-12T04:48:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T04:48:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move DSM to `7.3.2-86009-5` or later on the 7.3 branch, or `7.4.1-90080-1` or later on the 7.4 branch.","reach":"network","title":"Synology DSM: TaskScheduler API lets authenticated users write files","impact":"medium","summary":"Synology DiskStation Manager has a missing authorization check in its TaskScheduler API. A remote user with a valid account can write specific files on the NAS.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","self-hosted","nas"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user writes specific files on the NAS","analyst_note":"Confirm the affected file set and whether the flaw is reachable by default; check Synology's security advisory for details.","how_to_check":"- Check the installed DSM version in Control Panel > Info Center (or run `cat /etc/VERSION` over SSH) and compare it with the fixed releases.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-version","no-remote-accounts"],"who_is_affected":"Owners of Synology DSM systems running a version before 7.3.2-86009-5 or 7.4.1-90080-1 are exposed, provided an attacker holds a valid user account on the NAS. Systems on fixed versions or without remote user accounts are not affected by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4535,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':69C '-2026':11A,14A '-5':65C '-81559':12A,15A '-86009':64C '-90080':68C '7.3.2':63C '7.4.1':67C 'account':41B 'allow':70C 'api':4A,34B,56C 'authent':6A,72C 'author':29B,51C 'check':30B 'cve':10A,13A 'diskstat':24B,59C 'dsm':2A,16B,61C 'file':9A,45B,77C 'host':21B 'infrastructur':17B 'let':5A 'manag':25B,60C 'miss':28B,50C 'nas':18B,48B 'remot':36B,71C 'self':20B 'self-host':19B 'specif':44B,76C 'synolog':1A,22B,23B,58C 'taskschedul':3A,33B,55C 'user':7A,37B,73C 'valid':40B 'vulner':52C 'write':8A,43B,75C","nicknames":[],"mitigations":[],"who_affected":"Owners of Synology DSM systems running a version before 7.3.2-86009-5 or 7.4.1-90080-1 are exposed, provided an attacker holds a valid user account on the NAS. Systems on fixed versions or without remote user accounts are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-2026':11A,14A '-81559':12A,15A 'api':4A 'authent':6A 'cve':10A,13A 'dsm':2A 'file':9A 'let':5A 'synolog':1A 'taskschedul':3A 'user':7A 'write':8A","search_b":"'account':41B 'api':34B 'author':29B 'check':30B 'diskstat':24B 'dsm':16B 'file':45B 'host':21B 'infrastructur':17B 'manag':25B 'miss':28B 'nas':18B,48B 'remot':36B 'self':20B 'self-host':19B 'specif':44B 'synolog':22B,23B 'taskschedul':33B 'user':37B 'valid':40B 'write':43B","search_c":"'-1':69C '-5':65C '-86009':64C '-90080':68C '7.3.2':63C '7.4.1':67C 'allow':70C 'api':56C 'authent':72C 'author':51C 'diskstat':59C 'dsm':61C 'file':77C 'manag':60C 'miss':50C 'remot':71C 'specif':76C 'synolog':58C 'taskschedul':55C 'user':73C 'vulner':52C 'write':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81559","severity":null,"published_at":"2026-11-12T04:17:21+00:00","modified_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","fetched_at":"2026-11-12T04:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}