QNAP File Station CVE-2026-24724

Exploitation requires the attacker to already hold a valid authenticated user account on File Station 5 (CVSS PR:L), meaning any account that can log into the NAS web UI - including low-privileged or guest-level users - is sufficient; no admin role and no user interaction from a victim is needed. The target must be a QNAP NAS running File Station 5 at a version between 5.5.0 and 5.5.6.5243 (versions outside this range, and File Station deployments patched to 5.5.6.5243 or later, are not vulnerable). Network reachability to the NAS web interface is required, which is satisfied either on the LAN or for internet-exposed deployments (myQNAPcloud, port-forwarded HTTP/HTTPS). The main limiting factor is the credential requirement: defenders who enforce strong authentication, disable guest accounts, and restrict File Station to trusted networks meaningfully constrain real-world exploitability.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N indicates a network-reachable, low-complexity attack that requires only low-privileged credentials and no user interaction, yielding high confidentiality and integrity impact but no availability impact - consistent with an authorization bypass that exposes other users' files. The 8.6 score is in the High band and reasonable given QNAP NAS devices' historical position as a high-value ransomware and data-theft target. EPSS, KEV, and POC signals are not present in the provided data: there is no public exploit identified at time of analysis and no CISA KEV listing, so this is not currently a confirmed in-the-wild threat. The realistic risk is meaningfully shaped by the PR:L requirement - exploitation depends on the attacker first obtaining any valid user account (via credential stuffing, phishing, prior breach, or guest accounts), which is plausible on multi-user NAS deployments but does cap mass exploitation. A notable data conflict: the description names 'File Station 6' while every other field references File Station 5; defenders should verify with the QSA-26-29 advisory which app version they actually run.

An attacker obtains valid low-privileged File Station credentials on a target QNAP NAS - for example through credential stuffing against an internet-reachable NAS, a phished employee account, or abuse of a stale guest account. Authenticated as that user, the attacker sends crafted File Station requests that the application accepts despite the user lacking permission, allowing them to read, copy, or modify files belonging to other users or shares they should not reach. No public exploit is identified at time of analysis, but the low attack complexity and clear authorization-check failure make weaponization straightforward once the specific vulnerable endpoint is identified.