CVE-2026-13673

HighCVSS 8.8/10Last modified Sep 18, 2026

Description

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
SynologyDiskStation Manager (DSM)>= 7.4, < 7.4-90075; >= 7.3.2, < 7.3.2-86009-4; >= 7.2.2, < 7.2.2-72806-9; >= 7.2.1, < 7.2.1-69057-12

References

Timeline

Published
Sep 18, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-136767.5fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path cCVE-2026-13687.5The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowCVE-2026-136832.7An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskCVE-2026-136849.8An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9,CVE-2026-13694.3The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to anCVE-2026-136907.4The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowingCVE-2026-136925.3The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications,CVE-2026-136935.9The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching iCVE-2026-136946.5The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired,CVE-2026-136958.8SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sCVE-2026-136968.8Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP InCVE-2026-136979.1undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before