anonhaven

CVE-2026-9491

MEDIUM CVSS 3.1: 4.3 EPSS 0.40%
Updated Sep 01, 2026
Synology
Parameter Value
CVSS 4.3 (MEDIUM)
Affected Versions before 2.4.5
Type CWE-918 (Server-Side Request Forgery (SSRF))
Vendor Synology
Public PoC No

A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

Vulnerable Products

synology:synology chat server

References 1

https://www.synology.com/en-global/security/advisory/Synology_SA_26_10
Synology-SA-26:10 Synology Chat Server
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-9548

Synology

6.5

CVE-2026-40541

Synology

9.0

CVE-2026-4793

Microsoft

7.3

CVE-2024-47273

Synology

4.3

CVE-2024-47263

Synology

4.1