A vulnerability exists in the Synology Storage Manager package that occurs when the application performs GET requests containing sensitive query strings related to volume encryption. The flaw allows local attackers to retrieve confidential information that should be protected by encryption. This weakness is classified as CWE‑598, indicating that sensitive data is exposed during a request that should not carry such data. The primary impact is information disclosure, which could enable an attacker to obtain encryption keys, configuration details, or other privileged data from the local host.

The affected product is Synology Storage Manager, specifically versions prior to 1.0.1‑1100. Versions 1.0.1‑1100 and later contain the fix that removes the exposure of sensitive query parameters during GET requests.

The CVSS score of 6.2 reflects moderate severity and the absence of an EPSS score suggests limited or uncertain exploitation likelihood at present, though the local nature of the attack vector allows an attacker who can execute code or interact with the system to exploit the flaw. The vulnerability is not listed in CISA’s KEV catalog, indicating that there is no known widespread exploitation. Nevertheless, the potential to expose sensitive encryption-related data warrants timely remediation. The risk is heightened if the system allows local users or services with elevated privileges to access the affected endpoints.