Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Synology DSM lets authenticated users read/write files

CVE-2026-13673 · published 1 month ago
Summary

Versions of Synology DiskStation Manager before the latest updates let a logged‑in user change the permissions on a core LDAP function. This mistake can let that user read or change any file on the device and even crash the system. Update DSM to the newest release as soon as possible to fix the permission settings.

What to do
  • Update synology diskstation manager (dsm) to version 7.4-90075 or later.
Affected software
VendorProductAffected versions
synology diskstation manager (dsm) < 7.4-90075
Original advisory text
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows rem...
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published18 Sep 2026
Updated4 Nov 2026
First seen18 Sep 2026
Sources
CVE-2026-13673 · NVD
CVE-2026-13673 · MITRE
Track software like this
Free during beta