CVE-2023-50363: An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended acces...

Summary

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.

We have already fixed the vulnerability in the following versions:
QTS 5...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
qnap	qts	5.1.0.2348 5.1.0.2399 5.1.0.2418 5.1.0.2444 5.1.0.2466 5.1.1.2491 5.1.2.2533 5.1.3.2578 5.1.4.2596 5.1.5.2645 5.1.5.2679 `cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325::::::`
qnap	quts_hero	h5.1.0.2409 h5.1.0.2424 h5.1.0.2453 h5.1.0.2466 h5.1.1.2488 h5.1.2.2534 h5.1.3.2578 h5.1.4.2596 h5.1.5.2647 h5.1.5.2680 `cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525::::::`

Original advisory text

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended acces...

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later

References

https://www.qnap.com/en/security-advisory/qsa-24-20 Vendor Advisory