{"id":"CVE-2026-87801","kind":"vulnerability","aliases":["CVE-2026-87801"],"related":[],"title":"Synology DSM: API framework flaw lets logged-in users read arbitrary files","description":"An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files.","summary":"An insertion of sensitive information into sent data flaw in the API framework of Synology DiskStation Manager lets a remote user with an account read arbitrary files on the NAS. The NVD entry rates it medium with a CVSS score of 6.5.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Synology DiskStation Manager (DSM)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["no-synology-nas","patched-dsm"],"how_to_check":"- Open DSM and check the installed version under Control Panel > Info Center (unknown exact path beyond this; sources do not say more)\n- Compare the version against the fixed builds listed in the fix field","fix":"- Synology DSM 7.3 branch: `7.3.2-86009-5` or later\n- Synology DSM 7.4 branch: `7.4.1-90080-1` or later","status":"open","published_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","triaged_at":"2026-11-12T04:47:48+00:00","updated_at":"2026-11-12T04:47:48+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T04:47:48Z","model":"claude-haiku-5-5","output":{"fix":"- Synology DSM 7.3 branch: `7.3.2-86009-5` or later\n- Synology DSM 7.4 branch: `7.4.1-90080-1` or later","reach":"network","title":"Synology DSM: API framework flaw lets logged-in users read arbitrary files","impact":"medium","summary":"An insertion of sensitive information into sent data flaw in the API framework of Synology DiskStation Manager lets a remote user with an account read arbitrary files on the NAS. The NVD entry rates it medium with a CVSS score of 6.5.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"remote authenticated user reads arbitrary files on the NAS","analyst_note":"","how_to_check":"- Open DSM and check the installed version under Control Panel > Info Center (unknown exact path beyond this; sources do not say more)\n- Compare the version against the fixed builds listed in the fix field","plain_action":"","product_name":"Synology DiskStation Manager (DSM)","needs_analyst":false,"not_affected_if":["patched-dsm","no-synology-nas"],"who_is_affected":"Synology DiskStation Manager installs older than the fixed builds are affected, and the attacker needs a valid DSM user account first. Teams that run no Synology NAS, or whose DSM is on a fixed build, can skip it. Sources do not say whether any non-default setting is required.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4535,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':98C '-2026':15A,18A '-5':94C '-86009':93C '-87801':16A,19A '-90080':97C '6.5':72B '7.3.2':92C '7.4.1':96C 'account':54B 'allow':99C 'api':3A,42B,84C 'arbitrari':12A,56B,105C 'authent':101C 'cve':14A,17A 'cvss':69B 'data':38B,80C 'diskstat':46B,88C 'diskstation':21A 'dsm':2A,23A,24B,90C 'entri':63B 'file':13A,57B,106C 'flaw':5A,39B 'framework':4A,43B,85C 'host':29B 'inform':35B,77C 'infrastructur':25B 'insert':32B,74C 'let':6A,48B 'log':8A 'logged-in':7A 'manag':47B,89C 'manager':22A 'medium':66B 'nas':26B,60B 'nvd':62B 'rate':64B 'read':11A,55B,104C 'remot':50B,100C 'score':70B 'self':28B 'self-host':27B 'sensit':34B,76C 'sent':37B,79C 'synolog':1A,30B,45B,87C 'synology':20A 'user':10A,51B,102C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Synology DiskStation Manager installs older than the fixed builds are affected, and the attacker needs a valid DSM user account first. Teams that run no Synology NAS, or whose DSM is on a fixed build, can skip it. Sources do not say whether any non-default setting is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["diskstationmanagerdsm","synologydiskstationmanagerdsm"],"ptokens":["diskstation","dsm","manager","synology"],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology","vendor"],"campaign_type":null,"search_a":"'-2026':15A,18A '-87801':16A,19A 'api':3A 'arbitrari':12A 'cve':14A,17A 'diskstation':21A 'dsm':2A,23A 'file':13A 'flaw':5A 'framework':4A 'let':6A 'log':8A 'logged-in':7A 'manager':22A 'read':11A 'synolog':1A 'synology':20A 'user':10A","search_b":"'6.5':72B 'account':54B 'api':42B 'arbitrari':56B 'cvss':69B 'data':38B 'diskstat':46B 'dsm':24B 'entri':63B 'file':57B 'flaw':39B 'framework':43B 'host':29B 'inform':35B 'infrastructur':25B 'insert':32B 'let':48B 'manag':47B 'medium':66B 'nas':26B,60B 'nvd':62B 'rate':64B 'read':55B 'remot':50B 'score':70B 'self':28B 'self-host':27B 'sensit':34B 'sent':37B 'synolog':30B,45B 'user':51B","search_c":"'-1':98C '-5':94C '-86009':93C '-90080':97C '7.3.2':92C '7.4.1':96C 'allow':99C 'api':84C 'arbitrari':105C 'authent':101C 'data':80C 'diskstat':88C 'dsm':90C 'file':106C 'framework':85C 'inform':77C 'insert':74C 'manag':89C 'read':104C 'remot':100C 'sensit':76C 'sent':79C 'synolog':87C 'user':102C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87801","severity":null,"published_at":"2026-11-12T04:17:21+00:00","modified_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","fetched_at":"2026-11-12T04:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}