CVE-2025-58468 is a cross‑site request forgery flaw in QNAP Systems Inc.’s Notification Center. A remote attacker can forge a request that a victim’s browser already authenticates, enabling the attacker to perform actions with the victim’s privileges or hijack the user account. The flaw is a standard CSRF weakness (CWE‑352) that can result in unauthorized access, configuration changes, or other privileged operations on the affected device.

The vulnerability affects QNAP Systems Inc.’s Notification Center software prior to release 1.10.0.3291. The affected versions include all builds older than 1.10.0.3291, which are running on QNAP NAS devices that host the Notification Center service.

The CVSS score of 5.1 places the flaw in the medium‑severity range. EPSS is not available, and the vulnerability is not listed in KEV, indicating no known mass exploitation. Attackers still need to craft a malicious request and rely on the victim to be authenticated to the device, making the exploitation likely reliant on social engineering or a compromised user session. Nevertheless, because CSRF can be triggered from any domain, the risk remains moderate until the vendor release is applied.