Server-Side Request Forgery Vulnerability in Synology Chat Server
CVE-2026-9491

4.3MEDIUM

Key Information:

Vendor

Synology
Status
Synology Chat Server
Vendor
CVE Published:
28 August 2026

What is CVE-2026-9491?

A server-side request forgery (SSRF) vulnerability exists within the webhook functionality of Synology Chat Server prior to version 2.4.5-22148. This flaw allows remote authenticated users to exploit the system, gaining access to non-sensitive information. This exploitation could lead to further potential risks depending on the system configuration, highlighting the importance of timely updates and security best practices.

Affected Version(s)

Synology Chat Server *

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lam Jun Rong and Javier Koh, Cyber Specialists of the Digital and Intelligence Service (DIS) working with the Centre for Strategic Infocomm Technologies (CSIT) and Dr Joseph Teo, CSIT
.