A missing authorization flaw in QNAP’s QuMagie software allows an attacker who can reach the application from a network to retrieve or manipulate data and settings that should be protected, potentially exposing sensitive files and configuration information. The weakness corresponds to missing authorization controls and a possible leakage of authentication credentials, based on the referenced CWEs.

QNAP Systems Inc. QuMagie versions prior to 2.9.0 are affected. The issue was fixed in QuMagie 2.9.0 and later releases.

The vulnerability is scored at 6.6 on the CVSS scale, indicating medium severity. The EPSS score indicates a very low exploitation probability, below 1%, and the absence of a KEV listing does not diminish the risk to users that access QuMagie over a network. Adversaries most likely need remote network access to the QuMagie service; the flaw allows exploitation without further privileges, leading to unauthorized data recovery or modification.