Synology DSM Desktop API Info Disclosure 7.3.2-86009-2 & earlier
CVE-2026-40533 Published on September 18, 2026
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.
Vulnerability Analysis
CVE-2026-40533 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Exposure of Sensitive Information Through Data Queries
When trying to keep information confidential, an attacker can often infer some of the information by using statistics. In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
Products Associated with CVE-2026-40533
Want to know whenever a new CVE is published for Synology Diskstation Manager? stack.watch will email you.
Affected Versions
Synology DiskStation Manager (DSM):- Version 7.3 and below 7.3.2-86009-2 is affected.
- Version 7.2.2 and below 7.2.2-72806-7 is affected.
- Version 7.2.1 and below 7.2.1-69057-10 is affected.
- Before 7.2.1 is unknown.