CVE-2026-26236

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.qnap.com/en/security-advisory/qsa-26-35

Configurations

Configuration 1 (hide)

cpe:2.3:a:qnap:qumagie:*:*:*:*:*:*:*:*

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Se ha reportado una vulnerabilidad de autorización faltante que afecta a QuMagie. Los atacantes remotos pueden entonces explotar la vulnerabilidad para acceder a datos no autorizados o realizar acciones no autorizadas. Ya hemos corregido la vulnerabilidad en la siguiente versión: QuMagie 2.9.0 y posteriores

17 Jun 2026, 13:20

Type	Values Removed	Values Added
References	~~{'url': 'https://www.qnap.com/en/security-advisory/qsa-26-36', 'tags': ['Broken Link'], 'source': 'security@qnapsecurity.com.tw'}~~	() https://www.qnap.com/en/security-advisory/qsa-26-35 -

12 Jun 2026, 15:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
First Time		Qnap qumagie Qnap
References	~~() https://www.qnap.com/en/security-advisory/qsa-26-36 -~~	() https://www.qnap.com/en/security-advisory/qsa-26-36 - Broken Link
CPE		cpe:2.3:a:qnap:qumagie::::::::

09 Jun 2026, 05:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 05:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-26236

Mitre link : CVE-2026-26236

CVE.ORG link : CVE-2026-26236

JSON object : View

Products Affected

qnap

qumagie

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-26236", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26236", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T13:17:55.705995Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@qnapsecurity.com.tw", "affectedData": [{"vendor": "QNAP Systems Inc.", "product": "QuMagie", "versions": [{"status": "affected", "version": "2.9.0", "lessThan": "2.9.1", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T05:16:34.453", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-26-35", "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions.\n\nWe have already fixed the vulnerability in the following version:\nQuMagie 2.9.0 and later"}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad de autorizaci\u00f3n faltante que afecta a QuMagie. Los atacantes remotos pueden entonces explotar la vulnerabilidad para acceder a datos no autorizados o realizar acciones no autorizadas.\n\nYa hemos corregido la vulnerabilidad en la siguiente versi\u00f3n:\nQuMagie 2.9.0 y posteriores"}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qnap:qumagie:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B04C9EA2-D3DA-4201-9509-E5D601C7A184", "versionEndExcluding": "2.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}