DiskStation Manager (< 7.4.1-90080-1, < 7.3.2-86009-5)

An SQL injection vulnerability in the Synology DiskStation Manager (DSM) User API, tracked as CVE-2026-81584, allows remote attackers who have compromised an integrated LDAP or Active Directory server to perform arbitrary file operations or trigger a denial-of-service.