CVE-2026-24724: File Station 6 Auth Bypass Vulnerability

CVE-2026-24724 Overview

CVE-2026-24724 is an incorrect authorization vulnerability affecting QNAP File Station 6. The flaw allows a remote attacker with a valid user account to bypass intended access restrictions on the network-attached storage application. The weakness is classified under [CWE-863] Incorrect Authorization. QNAP has addressed the issue in File Station 5 5.5.6.5243 and later. Exploitation requires authentication but no user interaction and can be performed remotely over the network.

Critical Impact

An authenticated remote attacker can bypass access controls in File Station 6, exposing files and directories that should remain restricted to other users on the QNAP NAS device.

Affected Products

• QNAP File Station 6 (prior to fixed release)
• QNAP File Station 5 versions prior to 5.5.6.5243
• QNAP NAS devices running vulnerable File Station builds

Discovery Timeline

• 2026-06-10 - CVE-2026-24724 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-24724

Vulnerability Analysis

The vulnerability resides in the authorization logic of QNAP File Station 6, a web-based file management application bundled with QNAP NAS devices. File Station is responsible for enforcing user-level and share-level permissions when handling file operations such as browse, download, upload, and share creation. The flaw allows a low-privileged authenticated user to perform actions or access resources that should be restricted based on the configured access control policy.

Because File Station is exposed over the QNAP web administration interface, the attack surface is reachable across the network without local access. The attack complexity is low, and no user interaction is required from a victim. Successful exploitation yields high impact on confidentiality and integrity of stored data, while availability is not affected. The EPSS probability is low at the time of publication, indicating no observed exploitation activity in the wild.

Root Cause

The root cause is improper enforcement of authorization checks ([CWE-863]) within File Station 6 request handlers. The application validates that a request is authenticated but fails to fully validate that the requesting user is permitted to act on the targeted resource, allowing access decisions to be bypassed.

Attack Vector

The attack vector is network-based and requires the attacker to already hold a valid user account on the QNAP NAS. Account access can be obtained through credential theft, phishing, password reuse, or by abusing accounts intended for limited shares. Once authenticated, the attacker issues crafted File Station requests that reference resources outside the intended permission scope. No verified public proof-of-concept code is available. See the QNAP Security Advisory QSA-26-29 for vendor-supplied technical details.

Detection Methods for CVE-2026-24724

Indicators of Compromise

• Authenticated File Station requests from a single account accessing files or shares outside that account's normal working set
• Unexpected download, copy, or share-link creation events in QNAP system logs tied to low-privileged users
• Access attempts to administrative or other users' home directories by non-privileged accounts

Detection Strategies

• Review QNAP System Event Log and File Station access logs for anomalous file access patterns by individual users
• Correlate authentication events with subsequent file operations to identify accounts performing access outside their role baseline
• Alert on bulk file enumeration or download volume that deviates from per-user historical baselines

Monitoring Recommendations

• Forward QNAP NAS logs to a centralized SIEM or data lake for retention and cross-correlation
• Monitor outbound traffic from the NAS for large data transfers that may indicate post-exploitation exfiltration
• Track creation of new share links and permission changes performed by non-administrative accounts

How to Mitigate CVE-2026-24724

Immediate Actions Required

• Update File Station to 5.5.6.5243 or later through the QNAP App Center on every affected NAS device
• Audit existing QNAP user accounts and disable or remove unused, inactive, or shared accounts
• Enforce strong, unique passwords and enable two-factor authentication for all QNAP user accounts

Patch Information

QNAP has resolved CVE-2026-24724 in File Station 5 5.5.6.5243 and later. Administrators should install the fix through the QNAP App Center or by downloading the package directly from the QNAP Security Advisory QSA-26-29. Reboot the device if prompted and verify the installed File Station version after applying the update.

Workarounds

• Restrict access to the QNAP web administration interface to trusted internal networks using firewall rules or VPN-only access
• Disable File Station on devices where it is not required until the patch can be applied
• Reduce per-user permissions to the minimum required shares and folders to limit blast radius of any bypass

# Verify the installed File Station version on a QNAP NAS via SSH
/sbin/getcfg -f /etc/config/qpkg.conf "File Station 5" Version

# Restrict the QNAP admin web interface to a trusted management subnet (example using iptables)
iptables -A INPUT -p tcp --dport 8080 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP