Synology DSM's Auth API SQL Injection Reaches Files Beyond the Login Prompt
Synology published advisory SA-26:19 for DiskStation Manager on 2026-11-10. CVE-2026-76954 is an SQL injection in the DSM Auth API. The vendor says a remote attacker can read or write arbitrary files and conduct denial-of-service attacks without authentication.
The CVE record assigns a CVSS v3.1 score of 9.8 with a network vector, no privileges and no user interaction. Those values describe the potential impact stated by the vendor. They do not establish that a particular NAS was accessed.
Why the login API carries so much authority
Authentication services read identity records, session state and configuration. A query flaw there can expose more than a list of usernames if the application account can reach files outside the authentication database.
Synology states that the effect includes arbitrary file read and write. The public record does not publish the vulnerable query, a payload or an exploitation chain. Defenders should avoid guessing the exact database schema or claiming that every DSM file is writable. The safer conclusion is that the Auth API lacks an adequate input boundary and that the underlying process has enough file authority to make the impact serious.
Availability impact matters for a storage appliance. Login, file services, replication, backup jobs and administration may depend on the same system services. An attacker does not need to encrypt files to disrupt an organization if the management and authentication path becomes unavailable.
Affected builds
The advisory lists affected DSM releases before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 and 7.4.1-90080-1. Administrators should compare the full build string, including the update suffix, with the advisory. A branch number alone is insufficient.
Internet-facing DSM portals, QuickConnect exposure and remote management addresses deserve immediate inventory. A NAS that is not reachable from the internet can still be exposed through a compromised VPN account, a partner network or a weak segmentation boundary.
Contain and investigate
Upgrade to the fixed build for the installed branch. Until that is complete, restrict DSM and related remote-access paths to trusted management networks. Remove unnecessary port forwarding and review accounts that can administer the appliance.
Check authentication and web logs for abnormal requests to DSM endpoints before and after the advisory. Preserve the raw events, the running build, configuration exports and any unexpected file changes. Take a protected backup before remediation if the device may already be compromised.
Rotate credentials and session material if there is evidence of unauthorized access. Review scheduled tasks, external access settings and administrator accounts. The vendor advisory is the authority for fixed builds; incident evidence determines whether a device needs recovery rather than a patch alone.
Operational judgment
NAS appliances often hold backups, shared files and credentials for other systems. Treating CVE-2026-76954 as a single application vulnerability misses the downstream trust. The response should connect the DSM build inventory to the data stored on the device and to the accounts that can reach its management interface.
Top comments (0)