Improper file access permission settings in Synology Assistant

CSIRTS triage

What

Synology Assistant is configured with improper file access permission settings, potentially allowing unauthorized file access.

Who is affected

Users running Synology Assistant with the misconfigured permissions.

Urgency

Remediation is necessary to prevent unauthorized access to files on affected systems.

Action

Update Synology Assistant to a version with corrected file access permissions or manually adjust permission settings per Synology's guidance.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

JVN (Japan Vulnerability Notes) (JP · national-cert · site)

Severity

unknown

Published

2026-08-17

Exploitation

Not in CISA KEV at last sync

Original advisory: https://jvn.jp/en/jp/JVN91713656/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-47930.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownVulnerability in Synology Assistant (August 10, 2026)cert-fr-avis
• highCVE-2026-4793: An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows …nvd

Recent advisories for Improper file access

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownCVE-2026-79259: Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a re…nvd · 2026-08-25
• unknownCVE-2026-79151: Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a re…nvd · 2026-08-25
• mediumCVE-2026-63693: Dell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following') vu…nvd · 2026-08-24
• unknownCVE-2026-64960: ATutor Gameme module allows users to upload files of any type and extension without restrictio…nvd · 2026-08-20
• mediumCVE-2026-56796: Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before…nvd · 2026-08-19
• mediumCVE-2026-49500: Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain an Improper Link Re…nvd · 2026-08-18

More from JVN (Japan Vulnerability Notes)

• unknownAndroid App "Myna Point" vulnerable to improper access restriction2026-08-26
• unknownMultiple vulnerabilities in CorvusSKK2026-08-26
• unknownFURUNO ELECTRIC FA-50 CLASS B AIS TRANSPONDER uses hard-coded credentials and misses authentication for additi…2026-08-26
• unknownApache Struts 2 vulnerable to resource exhaustion2026-08-25
• unknownMultiple vulnerabilities in SKYSEA Client View and SKYMEC IT Manager2026-08-24