The vulnerability is a missing authorization flaw in the AddOns functionality of Synology Surveillance Station. Remote authenticated users who possess administrator privileges can obtain sensitive information through unspecified vectors. This flaw prevents proper privilege checks, potentially exposing confidential data, and is categorized as CWE-862.

Synology Surveillance Station is affected. Users running any version prior to 9.2.2-11575 or 9.2.2-9575 are at risk. The issue arises in the AddOns section of the application, which is part of the surveillance firmware package.

The CVSS score of 4.9 indicates a moderate impact. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be a remote authenticated administrator; the likely attack vector is via the web interface or API where AddOns are managed, inferred from the description that attackers can obtain sensitive information through unspecified vectors. An attacker with these credentials can extract sensitive configuration or other data before the patch is applied.