Which versions of QuMagie are affected by CVE-2026-26236?

QNAP QuMagie versions before 2.9.0 are vulnerable to unauthenticated remote authorization bypass attacks, allowing attackers to access sensitive data and execute unauthorized actions without…. A patch is available.

How to fix or mitigate CVE-2026-26236?

Within 24 hours: Identify all systems running QNAP QuMagie; restrict external network access via firewall rules; document current versions in use. Within 7 days: Implement network segmentation to isolate QuMagie servers from untrusted networks; enable comprehensive access logging and monitoring for suspicious data queries and action attempts. Within 30 days: Establish vendor contact and testing process for QuMagie 2.9.0 or later; conduct security assessment for signs of prior unauthorized access; develop upgrade deployment plan.

QuMagie CVE-2026-26236

Q: What is the CVSS score of CVE-2026-26236?

CVE-2026-26236 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35347 HIGH

Missing Authorization (CWE-862)

2026-06-09 qnap

GHSA-xxxj-w44j-q5cf

Authentication Bypass Qumagie

8.7

CVSS 4.0 · Vendor: qnap

Severity by source

Vendor (qnap) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (qnap) · only source for this CVE.

CVSS VectorVendor: qnap

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:28 vuln.today

CVSS changed

Jun 09, 2026 - 05:22 NVD

8.7 (HIGH)

DescriptionCVE.org

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions.

We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

AnalysisAI

Unauthorized data access and action execution in QNAP QuMagie versions prior to 2.9.0 allows remote attackers to bypass authorization checks over the network without authentication. The CVSS 4.0 score of 8.7 reflects high confidentiality impact with low attack complexity and no privileges required, though no public exploit identified at time of analysis and KEV listing is absent.

Technical ContextAI

QuMagie is QNAP's AI-powered photo management application that runs on QTS/QuTS hero NAS devices, providing facial recognition, object detection, and media organization features typically exposed over HTTP/HTTPS via the QNAP web interface. The root cause is CWE-862 (Missing Authorization), meaning the application performs sensitive operations without verifying whether the requesting principal is permitted to perform them - this is distinct from missing authentication, since the access control check itself is absent or incomplete on specific endpoints. The CPE string cpe:2.3:a:qnap_systems_inc.:qumagie:*:*:*:*:*:*:*:* confirms all versions of the QuMagie application are in scope prior to the fix.

RemediationAI

Upgrade QuMagie to the vendor-released patch version 2.9.0 or later via the QNAP App Center on the affected NAS, following guidance in the QNAP advisory QSA-26-36 at https://www.qnap.com/en/security-advisory/qsa-26-36. If immediate patching is not feasible, restrict network exposure of the QuMagie web interface by placing the NAS behind a VPN or firewall ACL that limits access to trusted management IPs only - note this breaks any external/mobile photo browsing workflows users may rely on. Additionally consider disabling the QuMagie application from the App Center as a temporary hard mitigation, which fully removes the attack surface but also disables all photo management features for end users until the upgrade is applied.