CVE-2026-44084

Analyzed Analyzed - Analysis Complete

Authorization Bypass in QNAP Video Station

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: QNAP Systems, Inc.

Description

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-44084

EUVD

EUVD-2026-101980

Affected Vendors & Products

Vendor	Product	Version / Range
qnap	video_station	From 5.8.0 (inc) to 5.8.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an authorization bypass vulnerability through user-controlled keys in Video Station. It allows remote attackers to bypass normal access controls and access sensitive data without proper authorization.

Detection Guidance

Detection requires checking if Video Station is running a vulnerable version. Compare your installed version against Video Station 5.8.8 or later. If your version is older, the system is likely vulnerable. No specific commands are provided in the context to detect exploitation attempts.

Impact Analysis

If exploited, attackers could gain unauthorized access to sensitive data stored or processed by Video Station. This may include personal information, confidential files, or other sensitive content depending on the system configuration.

Compliance Impact

The vulnerability allows remote attackers to obtain sensitive data through an authorization bypass, which could lead to unauthorized access to personal or confidential information. This may violate compliance requirements under GDPR and HIPAA, as both standards mandate strict protection of personal data and healthcare information.

Mitigation Strategies

Update Video Station to version 5.8.8 or later to address the authorization bypass vulnerability. Ensure no unauthorized access has occurred by reviewing system logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-44084. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70