CVE-2026-2237

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.synology.com/en-global/security/advisory/Synology_SA_26_01	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:synology:storage_manager:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:synology:diskstation_manager:7.2.1:::::::*
	cpe:2.3:o:synology:diskstation_manager:7.2.2:::::::*
	cpe:2.3:o:synology:diskstation_manager:7.3:::::::*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de uso del método de solicitud GET con cadenas de consulta sensibles en el cifrado de volumen del paquete Synology Storage Manager anterior a 1.0.1-1100 permite a usuarios locales en Windows obtener información sensible.

Information

Published : 2026-05-27 09:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-2237

Mitre link : CVE-2026-2237

CVE.ORG link : CVE-2026-2237

JSON object : View

Products Affected

synology

storage_manager
diskstation_manager

CWE

CWE-598

Use of HTTP Request With Sensitive Query String

{"id": "CVE-2026-2237", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2237", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T12:12:11.329662Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@synology.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@synology.com", "affectedData": [{"vendor": "Synology", "product": "Storage Manager", "versions": [{"status": "affected", "version": "*", "lessThan": "1.0.1-1100", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-05-27T09:16:27.877", "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_01", "tags": ["Vendor Advisory"], "source": "security@synology.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@synology.com", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information."}, {"lang": "es", "value": "Una vulnerabilidad de uso del m\u00e9todo de solicitud GET con cadenas de consulta sensibles en el cifrado de volumen del paquete Synology Storage Manager anterior a 1.0.1-1100 permite a usuarios locales en Windows obtener informaci\u00f3n sensible."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:synology:storage_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "756F5C37-D90E-4935-8A45-2A6833731D74", "versionEndExcluding": "1.0.1-1100"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:synology:diskstation_manager:7.2.1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "591E364C-B846-4FFF-815C-5E1BC2FB8A6C"}, {"criteria": "cpe:2.3:o:synology:diskstation_manager:7.2.2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4E22F435-F709-495B-84B4-A478C63331B9"}, {"criteria": "cpe:2.3:o:synology:diskstation_manager:7.3:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B4B9ADBD-1F6B-4BA9-9B78-042C5EF41EC4"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@synology.com"}