Synology Chat Server CVE-2026-9491

Exploitation requires a valid authenticated session with at least standard user privileges on the Synology Chat Server instance (CVSS PR:L). The webhook feature must be accessible to authenticated users - this is the default functional state of the application. Limiting factors include: authentication is mandatory (no unauthenticated path), the impact is restricted to non-sensitive information per the vendor description, and the scope is unchanged meaning the vulnerability does not enable lateral movement beyond information observable by the server process itself. The attack is not limited to any specific platform or OS configuration beyond running an unpatched version of Synology Chat Server before 2.4.5-22148.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the constrained impact: only confidentiality is affected (C:L), with no integrity or availability consequence, and scope is unchanged (S:U), confirming blast radius is limited to information the server can reach. The PR:L metric is a meaningful limiter - exploitation requires a valid authenticated session, ruling out unauthenticated mass scanning. EPSS data is not provided, and the absence of KEV listing and public POC code further supports treating this as a lower-priority item relative to unauthenticated or RCE-class issues. The description's qualification of 'non-sensitive information' also constrains the real-world impact; however, in environments where the Chat Server sits on a network with access to cloud metadata services or internal APIs, even non-sensitive data exfiltration via SSRF can aid reconnaissance. No conflicting signals exist in the available data.

An authenticated Chat Server user navigates to the webhook configuration and sets a webhook URL pointing to an internal cloud metadata endpoint such as http://169.254.169.254/latest/meta-data/ or an internal REST API. Upon triggering a chat event, the server fetches the attacker-controlled URL and the response is observable by the user, revealing non-sensitive information about the host environment or internal network topology. No public POC has been identified, but the attack is mechanically straightforward for any user with webhook configuration access.