QNAP QuMagie EUVD-2026-35354

Exploitation requires that the target QNAP NAS has the QuMagie application installed at version 2.9.0 and that the NAS web interface (where QuMagie is served) is reachable from the attacker's network position - typically LAN access, or WAN access when the user has enabled port forwarding, UPnP, or myQNAPcloud remote access for the NAS. Per the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication and no user interaction are required, and the description does not call out any non-default feature flag, so default 2.9.0 installs are exploitable. Limiting factors: the impact is bounded to confidentiality (VC:H, VI:N, VA:N) so the attacker gains 'unintended privileges' to read/access resources rather than write or destroy them, and NAS appliances not exposed beyond the LAN sharply reduce the attacker population to those already on the internal network.

The CVSS v4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H scores 8.7 (High), signaling that a remote, unauthenticated attacker can trigger the flaw over the network with low complexity and no user interaction to achieve a high confidentiality impact, while integrity and availability are unaffected - consistent with an IDOR that leaks or grants access to data the attacker should not see. No EPSS score and no SSVC decision data were supplied, and the vulnerability is not currently flagged in CISA KEV, so there is no quantitative signal of widespread exploitation; however, QNAP NAS appliances are a recurring target for opportunistic ransomware crews (Deadbolt, Qlocker, eCh0raid), which historically pivot quickly once advisories drop. Treat this as a real priority for any internet-reachable QuMagie deployment: the preconditions are minimal and the affected product is commonly exposed, even though no public PoC is currently identified.

An attacker scans Shodan/Censys for internet-exposed QNAP NAS web interfaces with QuMagie enabled, then issues crafted HTTP requests to a QuMagie API endpoint while substituting another user's object identifier (album ID, photo ID, share token, or user ID) in a parameter the server trusts without authorization checks. Because the flaw requires no authentication and no user interaction, the attacker iterates IDs to enumerate and exfiltrate private photo libraries belonging to other NAS users. No public exploit identified at time of analysis, but the IDOR pattern is trivial to reproduce once the vulnerable endpoint is identified by diffing 2.9.0 against 2.9.1.