CVE-2026-13673: Synology DSM Privilege Escalation Flaw

CVE-2026-13673 Overview

CVE-2026-13673 is an incorrect permission assignment vulnerability [CWE-732] in the Lightweight Directory Access Protocol (LDAP) API of Synology DiskStation Manager (DSM). The flaw allows remote authenticated users to read or write arbitrary files on the affected appliance and trigger denial-of-service conditions. Synology assigned the issue tracking identifier SA-26-13 and published fixes across four DSM release trains.

Critical Impact
Authenticated network attackers can read or write arbitrary files on DSM appliances and induce denial of service, undermining confidentiality, integrity, and availability of hosted data.

Affected Products

Synology DiskStation Manager (DSM) versions before 7.2.1-69057-12
Synology DiskStation Manager (DSM) versions before 7.2.2-72806-9
Synology DiskStation Manager (DSM) versions before 7.3.2-86009-4 and 7.4-90075

Discovery Timeline

2026-09-18 - CVE-2026-13673 published to the National Vulnerability Database
2026-09-18 - Last updated in the NVD database

Technical Details for CVE-2026-13673

Vulnerability Analysis

The LDAP API component in Synology DSM ships with permission assignments that do not adequately restrict access to filesystem resources exposed through the API. An authenticated user reaching the API over the network can invoke operations that read or write files outside the intended authorization scope. The same code paths can be abused to exhaust resources or leave the LDAP service in an unavailable state.

The issue affects DSM across multiple maintained release lines, including the 7.2.x, 7.3.x, and 7.4 branches. Synology addresses the flaw in DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.

Root Cause

The root cause is an incorrect permission assignment for a critical resource, classified under [CWE-732]. LDAP API handlers grant access rights to resources that should be reserved for higher-privileged principals. Because the authorization decision is made at the wrong layer, low-privileged authenticated sessions inherit the ability to perform sensitive file operations.

Attack Vector

The attack vector is network-based and requires valid credentials on the DSM appliance. An attacker with any authenticated session can issue crafted requests to the LDAP API to read sensitive files, overwrite configuration or system files, or repeatedly trigger error paths that render the service unavailable. No user interaction is required, and successful exploitation preserves the attacker's existing session context.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Synology Security Advisory SA-26-13 for vendor technical details.

Detection Methods for CVE-2026-13673

Indicators of Compromise

Unexpected LDAP API requests from authenticated user accounts that do not normally interact with directory services.
Modification timestamps on DSM system or configuration files that do not correspond to administrative activity or scheduled updates.
Repeated LDAP service crashes, restarts, or extended unavailability recorded in DSM system logs.
Outbound transfers of DSM configuration or credential files following LDAP API activity.

Detection Strategies

Audit DSM access logs for LDAP API calls originating from accounts without a documented directory administration role.
Correlate authenticated session activity with file integrity monitoring events on the DSM appliance.
Alert on anomalous request volumes or malformed payloads targeting LDAP endpoints.

Monitoring Recommendations

Forward DSM syslog and audit logs to a centralized SIEM for retention and correlation.
Baseline normal LDAP API usage per account, then alert on deviations in call frequency or accessed paths.
Monitor DSM service health metrics to catch denial-of-service patterns targeting the LDAP subsystem.

How to Mitigate CVE-2026-13673

Immediate Actions Required

Upgrade DSM to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 or later as applicable to your release train.
Inventory all DSM accounts and disable or reset credentials for accounts that are inactive or no longer required.
Restrict network reachability of DSM management and LDAP interfaces to trusted administrative networks.

Patch Information

Synology has released fixed builds addressing CVE-2026-13673 in DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Administrators should review the Synology Security Advisory SA-26-13 to confirm the applicable fixed version for their deployment before scheduling maintenance.

Workarounds

Limit DSM LDAP API exposure to segmented management networks using firewall rules until patches are applied.
Enforce strong authentication, including two-factor authentication, on all DSM accounts to reduce the pool of credentials usable for exploitation.
Reduce the number of accounts with any DSM login capability to the minimum necessary for operations.

bash

# Example: restrict DSM management interfaces at the network edge
# Replace values with your management subnet and DSM appliance address
iptables -A INPUT -p tcp --dport 389 -s 10.10.20.0/24 -d 10.0.0.50 -j ACCEPT
iptables -A INPUT -p tcp --dport 636 -s 10.10.20.0/24 -d 10.0.0.50 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -d 10.0.0.50 -j DROP
iptables -A INPUT -p tcp --dport 636 -d 10.0.0.50 -j DROP