Synology DiskStation Manager: Auth API missing authentication (CVE-2026-74857)
A missing authentication step in the Synology DiskStation Manager Auth API (CVE-2026-74857) allows a remote authenticated user to perform unauthorized arbitrary file operations and denial-of-service.
CVE search metadata
CVE search record: CVE-2026-74857. Severity: high. CVSS: 8.8. KEV: no. Product: DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1). Brief: Synology DiskStation Manager: Auth API missing authentication (CVE-2026-74857). Brief link: https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-auth-bypass-cve-2026-74857/
Triage facts
Revision 1- Applicability
- DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 09:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-74857 is a vulnerability in the Auth API component of Synology DiskStation Manager (DSM). The flaw involves a missing critical authentication step, which allows remote authenticated users to read or write arbitrary files on the system or conduct denial-of-service attacks.