CVE-2026-44083: QuMagie

Synopsis

An authorization bypass through user-controlled key vulnerability affects QNAP QuMagie versions before 2.9.1. The flaw is reachable over the network and requires no authentication, allowing a remote attacker to manipulate a key the application trusts in order to gain unintended privileges. Successful exploitation gives the attacker read access to confidential data stored within the application. A patched-image rebuild at QuMagie 2.9.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the QuMagie service over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or session credentials are needed; the attacker can send unauthenticated requests to the vulnerable endpoint.

• Victim interactionNot required

  The attacker does not need any user on the target system to click a link, open a file, or take any other action.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or other environmental factors need to be aligned.

Blast Radius

• The attacker reads confidential data stored inside QuMagie, such as photo libraries, album metadata, and any associated user records visible to the bypassed authorization context.
• Data integrity is not affected; the attacker cannot modify or delete stored content through this vulnerability alone.
• Service availability is not affected; the QuMagie instance continues running normally during and after exploitation.