Synology DiskStation Manager: Auth API SQL Injection (CVE-2026-76954)
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API of Synology DiskStation Manager (DSM) allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE search metadata
CVE search record: CVE-2026-76954. Severity: critical. CVSS: 9.8. KEV: no. Product: DiskStation Manager (< 7.2.1-69057-13, < 7.2.2-72806-10, < 7.3.2-86009-5, < 7.4.1-90080-1). Brief: Synology DiskStation Manager: Auth API SQL Injection (CVE-2026-76954). Brief link: https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-sqli-cve-2026-76954/
Triage facts
Revision 1- Applicability
- DiskStation Manager (< 7.2.1-69057-13, < 7.2.2-72806-10, < 7.3.2-86009-5, < 7.4.1-90080-1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 09:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Synology DiskStation Manager (DSM) contains an improper neutralization of special elements used in an SQL command vulnerability (CVE-2026-76954) within the Auth API. This vulnerability allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Impact
Successful exploitation can result in the ability to read or write arbitrary files and conduct denial-of-service attacks.
Recommendation
Apply updates provided by the vendor to remediate the vulnerability.