The vulnerability is an incorrect authorization flaw that enables an attacker who has first obtained a legitimate user account to access data and features beyond the intended permissions. This mis‑implemented access control is classified as CWE-863 and can lead to unauthorized disclosure and manipulation of protected information.

The affected vendor is QNAP Systems Inc. The product is File Station 5. Versions prior to 5.5.6.5243 are vulnerable. The advisory also references File Station 6, but the documented fix applies to the File Station 5 line.

The CVSS score of 6.2 indicates medium severity. The exploit requires an active user account, so an attacker must first compromise or guess legitimate credentials. Once authenticated, the attacker can bypass authorization controls. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the medium CVSS combined with the fact that the flaw impacts a popular NAS platform should cause organizations to treat it with priority.