QNAP Notes Station 3 CVE-2026-34008

Exploitation requires the attacker to already possess a local user account on a QNAP NAS device with the Notes Station 3 application installed (PR:L, AV:L) - it is NOT remotely exploitable by an unauthenticated attacker. The specific trigger is a critical resource (file or object) created by Notes Station 3 with incorrect/overly permissive access rights (CWE-732); any local account able to reach that resource can abuse it. Limiting factors: local access plus a valid low-privileged account are both mandatory, no user interaction is needed, and only deployments that have the Notes Station 3 app installed (not plain QNAP NAS) are affected. Remediation is upgrading to Notes Station 3 version 3.9.11 or later.

This is a locally-exploitable privilege/permission flaw (CWE-732, incorrect permission assignment) in QNAP Notes Station 3. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.5) is internally consistent with the description: a local attacker who already holds a low-privileged user account can leverage mis-assigned permissions on a critical resource to fully compromise confidentiality, integrity, and availability. The high score is driven by the triple-High impact, not by ease of reach - the Local attack vector (AV:L) and required pre-existing account (PR:L) are significant limiting factors that make this a lower real-world priority than its 8.5 suggests. No EPSS score is provided; the CVE is NOT on CISA KEV and no proof-of-concept is referenced, so there is no evidence of active exploitation - treat the 8.5 as high-severity-but-gated-by-local-access rather than an urgent internet-facing emergency. One signal tension worth noting: the sole descriptive Tag is 'Information Disclosure', yet the CVSS impact is VC:H/VI:H/VA:H (full compromise including integrity and availability), so the tag understates the actual scope - rely on the CVSS vector, not the tag, for impact.

An attacker who has obtained any local user account on a QNAP NAS running Notes Station 3 (for example a low-privileged shell or application user) abuses files or resources that were created with overly permissive access rights. By reading or modifying those critical resources they escalate to compromise the confidentiality, integrity, and availability of the system. No public exploit code is referenced, so exploitation would currently require independent development.