CVE-2026-26237: QuMagie

Synopsis

A missing authorization vulnerability affects QuMagie, a photo management application by QNAP Systems. The flaw is reachable over the network and requires no authentication, meaning any remote attacker who can reach the service can attempt exploitation. Successful exploitation gives an attacker read access to data they are not authorized to view. A patched-image rebuild at version 2.9.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the QuMagie service over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or session credential is needed; the vulnerability is exploitable by any unauthenticated remote party.

• Victim interactionNot required

  No user action is required; the attacker can trigger the vulnerability directly without involving a logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other unpredictable environmental factors.

Blast Radius

• An attacker reads data stored in QuMagie that they have no authorization to access, such as private photo libraries or associated metadata.
• Confidentiality of all user content within the affected QuMagie instance is compromised; integrity and availability of data are not affected based on the CVSS impact tokens.
• On a multi-user NAS deployment, unauthorized data access extends across all user accounts whose content is managed by the vulnerable QuMagie version.