High priorityDisclosed

Advisory · CVE-2026-13672

Synology DSM SSOAuth authorization bypass lets authenticated users read and write arbitrary files

Synology DiskStation Manager before 7.3.2-86009-5 and 7.4.1-90080-1 lets a remote authenticated user bypass authorization through a user-controlled key in SSOAuth and read or write arbitrary files.

Advisory published November 12, 2026Independent summary
Vendor
Synology
Product
DiskStation Manager (DSM)
Identifier / CWE
CVE-2026-13672
CWE-639
Action timing
Immediate
ELI5

Explain it like I’m five

When you sign in with single sign-on, Synology hands you a key that says which account you are. This flaw lets a signed-in user swap that key for someone else's, so the system treats them as an account with far more access than their own.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated session

    An attacker logs in to DSM with any valid low-privilege account.

  2. 02Key is user-controlled

    The SSOAuth flow accepts a key value supplied by the user.

  3. 03Authorization check skipped

    The attacker supplies a key that maps to a different identity, bypassing the intended authorization.

  4. 04Files exposed

    The attacker reads or writes arbitrary files and can cause denial of service.

What happened

Synology reports an authorization bypass through user-controlled key in the SSOAuth component of DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1. A remote authenticated user can exploit it to read or write arbitrary files and conduct denial-of-service attacks. Synology rates it important at CVSS 8.8.

What to do

  1. Upgrade DSM to 7.3.2-86009-5 or 7.4.1-90080-1, matching the installed branch, or a later release.
  2. Until patched, limit DSM access to trusted users and review which accounts hold SSO login rights.
  3. Review SSO and DSM access logs for logins or file activity that does not match the account that performed it.
  4. Check shared folders for unexpected reads or writes by low-privilege accounts.
  5. Confirm the patched DSM version is running after the upgrade.

Management note

Any valid account becomes a full file-access account while this is unpatched, so the exposure is every user on the box, not just admins. Patching matters most where DSM is shared with many accounts or exposed beyond the office network.