Which versions of QNAP File Station are affected by CVE-2026-24724?

QNAP File Station 5 contains an access control bypass allowing authenticated users with standard accounts to access confidential files and restricted operations beyond their assigned permissions.. A patch is available.

How to fix or mitigate CVE-2026-24724?

24 hours: Identify all QNAP File Station 5 deployments running versions 5.5.0-5.5.6.5243 and apply network-level access restrictions or enhanced monitoring. 7 days: Deploy available vendor patch to upgrade all affected systems to the patched version. 30 days: Conduct comprehensive access log review to identify any unauthorized file access during the vulnerability exposure window.

QNAP File Station CVE-2026-24724

Q: What is the CVSS score of CVE-2026-24724?

CVE-2026-24724 has a CVSS 4.0 base score of 6.2 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35980 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-10 qnap

GHSA-q4p9-vcgx-vmc3

Authentication Bypass File Station 5 Qnap Systems Inc

6.2

CVSS 4.0 · Vendor: qnap

Severity by source

Vendor (qnap) PRIMARY

6.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (qnap) · only source for this CVE.

CVSS VectorVendor: qnap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 23, 2026 - 09:22 NVD

HIGH MEDIUM

CVSS changed

Jul 23, 2026 - 09:22 NVD

8.6 (HIGH) 6.2 (MEDIUM)

Analysis Generated

Jun 10, 2026 - 06:21 vuln.today

Patch available

Jun 10, 2026 - 05:01 EUVD

CVSS changed

Jun 10, 2026 - 04:22 NVD

8.6 (HIGH)

CVE Published

Jun 10, 2026 - 03:15 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

AnalysisAI

Authorization bypass in QNAP File Station 5 (versions 5.5.0 through 5.5.6.5243) allows a remote attacker with a valid low-privileged user account to circumvent intended access restrictions and reach files or operations they should not be able to access. The flaw was reported by QNAP itself with a CVSS 4.0 score of 8.6 reflecting high confidentiality and integrity impact, and there is no public exploit identified at time of analysis. Note that the vendor description text references 'File Station 6,' but the CPE, affected version list, and fix data all point to File Station 5, which appears to be a typo in the advisory.

Technical ContextAI

File Station is QNAP's web-based file management application bundled with QTS/QuTS hero NAS appliances, providing browser access to shared folders, permissions management, and file operations. The root cause is classified as CWE-863 (Incorrect Authorization), meaning the application performs an authorization check but the check is implemented incorrectly - typically a missing role/ownership verification, a broken object-level access control, or a path/permission check that can be sidestepped after authentication. The affected CPE is cpe:2.3:a:qnap_systems_inc.:file_station_5, confirming this is the version 5 codebase of the application running on QNAP NAS devices, which are frequently exposed to the internet or accessible from untrusted networks via QNAP's myQNAPcloud and remote-access features.

RemediationAI

Apply the vendor-released patch: upgrade File Station 5 to version 5.5.6.5243 or later via the QNAP App Center on each affected NAS, per QNAP advisory QSA-26-29 (https://www.qnap.com/en/security-advisory/qsa-26-29). Until the upgrade is rolled out, reduce exposure by tightening account hygiene on the NAS - disable or remove unused/guest user accounts, enforce strong passwords and 2FA on every account that can authenticate to File Station, and restrict File Station access to trusted IP ranges via the QTS firewall or by disabling myQNAPcloud and remote port-forwarding for the File Station service (trade-off: legitimate users lose remote browser file access until the patch is applied). Auditing existing share permissions and reviewing recent File Station access logs for unexpected cross-user access is also worthwhile given the authorization-bypass nature of the flaw.