Missing Authorization Vulnerability in Synology BeeDrive for Desktop
CVE-2025-54159

7.5HIGH

Key Information:

Vendor

Synology
Status
Beedrive For Desktop
Vendor
CVE Published:
4 December 2025

What is CVE-2025-54159?

A severe vulnerability exists in Synology's BeeDrive for desktop software, which fails to enforce proper authorization checks. This oversight allows remote attackers to gain unauthorized access and delete arbitrary files, potentially leading to significant data loss and disruption. Users are urged to upgrade to the latest version to safeguard their data and prevent exploitation.

Affected Version(s)

BeeDrive for desktop *

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhao Runzi (赵润梓)
JSON
.
CVE-2025-54159 : Missing Authorization Vulnerability in Synology BeeDrive for Desktop