What is the CVSS score of EUVD-2026-52187?

EUVD-2026-52187 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Synology Assistant are affected by EUVD-2026-52187?

Synology Assistant versions prior to 7.0.7-50095 contain a file permission vulnerability in installation artifacts that could expose organizations to unauthorized data access and system disruption…. A patch is available.

How to fix or mitigate EUVD-2026-52187?

Within 24 hours, audit all systems running Synology Assistant to identify instances prior to version 7.0.7-50095 and assess local user access patterns to those systems. Within 7 days, deploy Synology Assistant version 7.0.7-50095 to development and staging environments to validate compatibility and functionality. Complete production deployment of version 7.0.7-50095 or later across all systems within 30 days, prioritizing systems with multiple local users or extended installation windows.

Synology Assistant EUVD-2026-52187

| CVE-2026-4793 HIGH

Incorrect Default Permissions (CWE-276)

2026-08-03 synology

GHSA-x8pf-pjxr-ccfw

Synology Privilege Escalation Synology Assistant

7.3

CVSS 3.1 · NVD

Severity by source

Vendor (synology) PRIMARY

HIGH

qualitative

NVD

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Local installation context mandates AV:L and UI:R; a standard low-privilege local account suffices for PR:L; arbitrary file read, write, and DoS capability justify C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (synology).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 21, 2026 - 16:43 vuln.today

v3 (cvss_changed)

CVSS changed

Aug 21, 2026 - 16:37 NVD

7.8 (HIGH) 7.3 (HIGH)

Analysis Updated

Aug 19, 2026 - 20:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 19, 2026 - 20:37 vuln.today

cvss_changed

CVSS changed

Aug 19, 2026 - 20:37 NVD

7.3 (HIGH) 7.8 (HIGH)

Analysis Generated

Aug 03, 2026 - 07:21 vuln.today

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

HIGH 7.3

DescriptionNVD

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation.

AnalysisAI

Incorrect default permissions in Synology Assistant before version 7.0.7-50095 expose locally created installation artifacts to unauthorized access, enabling low-privileged local users to read or write arbitrary files and trigger denial-of-service conditions during the installation window. The CVSS score of 7.3 (High) with C:H/I:H/A:H reflects the breadth of potential file system impact, though an EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no public exploitation activity at time of analysis. A vendor-released patch exists at version 7.0.7-50095, and no public exploit code has been identified.

Technical ContextAI

CWE-276 (Incorrect Default Permissions) describes a class of vulnerabilities where software applies overly permissive access controls to files, directories, or other resources it creates, allowing unintended parties to access or modify them. Synology Assistant (CPE: cpe:2.3:a:synology:synology_assistant:*:*:*:*:*:*:*:*) is a desktop utility used to discover, connect to, and manage Synology NAS appliances on a local network. During its installation routine, the installer creates files or directories with permissions that violate the principle of least privilege, opening a race or access window where any low-privileged local user can interact with those resources - reading sensitive content, overwriting files in privileged paths, or corrupting the installation state to induce denial-of-service. The CVSS AV:L and UI:R metrics confirm the flaw is local and tied to the installation execution context.

RemediationAI

Upgrade Synology Assistant to version 7.0.7-50095 or later, which corrects the incorrect default permissions applied during installation; this is the primary and only confirmed fix per vendor advisory Synology_SA_26_12 at https://www.synology.com/en-global/security/advisory/Synology_SA_26_12. If immediate upgrade is not feasible, restrict the local user context during installation by ensuring only trusted administrator accounts are active sessions on the system when the installer runs - this directly removes the untrusted-user access prerequisite (PR:L, UI:R). On multi-user systems, scheduling installation during maintenance windows with concurrent user sessions terminated eliminates the exploitation window without requiring a patch. There are no known workarounds that address the underlying permission flaw without upgrading.