VYPR
← All advisories
Medium severity6.2NVD Advisory· Published May 27, 2026

CVE-2026-2237

CVE-2026-2237

Description

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local attackers to obtain sensitive information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The Synology Storage Manager package before 1.0.1-1100 uses GET requests with sensitive query strings in volume encryption, allowing local attackers to obtain sensitive information.

Vulnerability

A use of GET request method with sensitive query strings vulnerability exists in the volume encryption functionality of the Synology Storage Manager package. This occurs when sensitive data is passed as query string parameters in GET requests. The vulnerability affects all versions of Storage Manager before 1.0.1-1100 for DSM 7.3, 7.2.2, and 7.2.1 [1].

Exploitation

A local attacker with no authentication required can exploit this vulnerability by observing GET request URLs that contain sensitive query strings. The vulnerability is present in the volume encryption feature, allowing an attacker to obtain sensitive information from request logs or network captures without any privileges [1].

Impact

Successful exploitation allows a local attacker to obtain sensitive information, leading to a confidentiality impact of High per the CVSS vector. No impact on integrity or availability [1].

Mitigation

The vulnerability is fixed in Storage Manager version 1.0.1-1100 and above. Users should upgrade their Storage Manager package to the fixed version. No workarounds are mentioned in the advisory [1].

References
  1. Synology_SA_26_01 | Synology Inc.

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

1

News mentions

0

No linked articles in our index yet.