Authorization Bypass in Synology DiskStation Manager SSOAuth
CVE-2026-13672

8.8HIGH

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
12 November 2026

What is CVE-2026-13672?

A user-controlled key vulnerability in the SSOAuth component of Synology's DiskStation Manager grants remote authenticated users the ability to bypass authorization mechanisms. This flaw can lead to the unauthorized reading or writing of arbitrary files, as well as potential denial-of-service attacks. Users are encouraged to update their systems to the latest versions to protect against this risk.

Affected Version(s)

DiskStation Manager (DSM) 7.4.1

DiskStation Manager (DSM) 7.4.1 < 7.4.1-90080-1

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-5

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

N/A
.