Permission Assignment Flaw in Download Station by QNAP
CVE-2026-34014

8.4HIGH

Key Information:

Vendor

QNAP
Status
Download Station
Vendor
CVE Published:
15 October 2026

What is CVE-2026-34014?

A permission assignment vulnerability in QNAP's Download Station allows local attackers with administrator access to exploit critical resources improperly. If exploited, this flaw can lead to unauthorized access, potentially compromising the entire system's integrity. Users are urged to update to versions 5.10.1.312 and later, or 5.11.2.321 and later to mitigate this issue.

Affected Version(s)

Download Station 5.10.x < 5.10.1.312

Download Station 5.11.x < 5.11.2.321

References

https://www.qnap.com/en/app_releasenotes/list.php?app_cho...
release-notes

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jun Rong
.