CVE-2026-44084
Qnap Video Station: authorisation bypass
- Risk score
- 57/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Affected
- Qnap Video Station
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Qnap Video Station: Amber, patch this week. A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
The flaws
- CVE-2026-44084: Authorisation bypass (CVSS 7.5 · EPSS 0%)
- CVE-2026-26244: SQL injection (CVSS 8.8 · EPSS 1%)
- CVE-2026-26245: SQL injection (CVSS 8.8 · EPSS 1%)
- CVE-2026-34015: Path traversal (CVSS 6.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Qnap Video Station
Where it stands
- No known exploitation
Connects to
- Same weakness: Authorisation bypass (CWE-639). 244 other warnings in 30 days
- Same product: Earlier Qnap Video Station warnings. 2 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Last activity 15 Oct 2026. Patch Forecast updates every hour.