CVE-2026-13672

CVSS 8.8 (high) · published 2026-11-12

An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.

Weakness: CWE-639

Source: NVD CVE-2026-13672

References

• https://www.synology.com/en-global/security/advisory/Synology_SA_26_18

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.