CVE-2026-44084

7.5High

Published 15 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-639

Impact

Remote unauthenticated attackers can access sensitive data by manipulating object references. They only need network access to the Video Station service.

Root cause

An insecure direct object reference (authorization bypass through user-controlled key) allows unauthorized data retrieval.

Affected systems

QNAP Video Station versions prior to 5.8.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Video Station to version 5.8.8 or later via the QTS App Center. If you cannot update immediately, disable or stop the Video Station app.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

References

https://www.qnap.com/en/app-release-notes?keyword=Video%20Station&app=VideoStationPro&product-line=nasRelease Notes

Source: nvd.nist.gov/vuln/detail/CVE-2026-44084