Forced Browsing in Wallpaper Path (DSM 7.x<7.2.1) Enables Auth Leak
CVE-2026-40532 Published on September 18, 2026
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
Vulnerability Analysis
CVE-2026-40532 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is a forced browsing Vulnerability?
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.
CVE-2026-40532 has been classified to as a forced browsing vulnerability or weakness.
Products Associated with CVE-2026-40532
Want to know whenever a new CVE is published for Synology Diskstation Manager? stack.watch will email you.
Affected Versions
Synology DiskStation Manager (DSM):- Version 7.3 and below 7.3.2-86009-2 is affected.
- Version 7.2.2 and below 7.2.2-72806-7 is affected.
- Version 7.2.1 and below 7.2.1-69057-10 is affected.
- Before 7.2.1 is unknown.