Which versions of QNAP QuMagie are affected by CVE-2026-44083?

QNAP QuMagie versions prior to 2.9.1 contain an authorization bypass allowing external, unauthenticated attackers to access restricted user photos and metadata.. A patch is available.

How to fix or mitigate CVE-2026-44083?

Within 24 hours: Inventory all QNAP QuMagie deployments and identify instances running versions prior to 2.9.1. Within 7 days: Obtain vendor-released patch version 2.9.1, test in non-production environment, and schedule deployment window. Within 30 days: Deploy QNAP QuMagie 2.9.1 across all affected systems and verify successful upgrade completion.

QNAP QuMagie CVE-2026-44083

Q: What is the CVSS score of CVE-2026-44083?

CVE-2026-44083 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35354 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-09 qnap

GHSA-9q66-9qq3-h395

Authentication Bypass Qumagie

8.7

CVSS 4.0 · Vendor: qnap

Severity by source

Vendor (qnap) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (qnap) · only source for this CVE.

CVSS VectorVendor: qnap

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 10:05 vuln.today

Patch available

Jun 09, 2026 - 09:01 EUVD

CVSS changed

Jun 09, 2026 - 08:22 NVD

8.7 (HIGH)

CVE Published

Jun 09, 2026 - 06:20 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to gain unintended privileges.

We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

AnalysisAI

Authorization bypass in QNAP QuMagie versions prior to 2.9.1 allows remote unauthenticated attackers to manipulate user-controlled keys (IDOR-class flaw) and gain unintended privileges on the photo management application. The QNAP-issued advisory QSA-26-35 confirms the issue and ships a fix in 2.9.1; no public exploit identified at time of analysis, and the flaw is not currently listed in CISA KEV.

Technical ContextAI

QuMagie is QNAP's AI-powered photo management application that runs on QTS/QuTS hero NAS appliances, typically exposed via the NAS web interface and accessible over the LAN or, when port-forwarded, the internet. The underlying weakness is CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR): the application accepts an identifier (such as an album, photo, user, or share ID) supplied by the client and uses it to look up or act upon a resource without verifying that the requesting principal is authorized for that specific object. The single CPE entry (cpe:2.3:a:qnap_systems_inc.:qumagie:*) and the EUVD range 'QuMagie 2.9.0 <2.9.1' indicate the vulnerable code path is confined to the QuMagie application layer rather than the underlying QTS firmware.

RemediationAI

Vendor-released patch: QuMagie 2.9.1 - upgrade via the QNAP App Center (Log in to QTS/QuTS hero → App Center → search for QuMagie → click Update) as documented in QSA-26-35 (https://www.qnap.com/en/security-advisory/qsa-26-35). Until the upgrade is applied, the most effective compensating control is to remove the NAS web interface from the public internet by disabling UPnP/port forwarding for the QuMagie/QTS ports (typically 8080/443) and restricting access to a VPN or trusted source IPs, accepting the trade-off that remote photo access for legitimate users will break until they connect through the VPN. As a tighter interim measure, temporarily stop or uninstall the QuMagie app from the App Center, which fully removes the attack surface at the cost of disabling photo browsing for all users until the patch is installed.