CVE-2026-24724

HighCVSS 8.1/10Last modified Jul 23, 2026

Description

An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	File Station 5	>= 5.5.0, < 5.5.6.5243

References

https://www.qnap.com/en/security-advisory/qsa-26-10

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-247279.3An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Managemen CVE-2026-247289.3A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025 CVE-2026-2472910.0An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10 CVE-2026-24737.7Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google CVE-2026-247319.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate CVE-2026-247326.6Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH CVE-2026-247333.7Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constra CVE-2026-247347.5Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's F CVE-2026-247357.5Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through CVE-2026-247368.8Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.2 CVE-2026-247378.1jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows user CVE-2026-247386.5gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts TLVs with lengths tha