Home

Description

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.

PUBLISHED Reserved 2026-02-09 | Published 2026-05-27 | Updated 2026-06-02 | Assigner synology




MEDIUM: 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Use of GET Request Method With Sensitive Query Strings

Product status

Default status
affected

* (semver) before 1.0.1-1100
affected

Credits

Simon Baaske (Serviceware) finder

References

www.synology.com/...obal/security/advisory/Synology_SA_26_01 (Synology-SA-26:01 Storage Manager) vendor-advisory

cve.org (CVE-2026-2237)

nvd.nist.gov (CVE-2026-2237)

Download JSON