Description
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later
Published: 2026-10-15
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

An incorrect permission assignment for a critical resource, specifically a world‑writable crontab path that is monitored and executed by a root‑owned process, allows a local attacker who has obtained a user account to gain root privileges on the system. The flaw is a classic inappropriate permissions issue (CWE‑732).

Affected Systems

The vulnerability affects QNAP Systems Inc. Notes Station 3, specifically versions prior to 3.9.11. The issue is fixed in Notes Station 3 3.9.11 and later.

Risk and Exploitability

The CVSS score of 8.5 reflects a high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access and an existing user account; once compromised, the attacker can execute arbitrary commands as root. The limited scope to local users reduces the overall exploitability but the impact remains significant due to elevated privileges.

Generated by OpenCVE AI on October 25, 2026 at 17:50 UTC.

Remediation

Vendor Solution

We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

OpenCVE Recommended Actions

  • Upgrade Notes Station 3 to version 3.9.11 or later.
  • Verify that the monitored crontab directory and its files are not world‑writable and are owned by root.
  • Apply least‑privilege principles to local user accounts and limit write access to critical system resources.

Generated by OpenCVE AI on October 25, 2026 at 17:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Title **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process
Weaknesses CWE-732
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: qnap

Published:

Updated: 2026-10-15T13:33:55.371Z

Reserved: 2026-03-25T06:18:24.663Z

Link: CVE-2026-34008

cve-icon Vulnrichment

Updated: 2026-10-15T13:33:51.298Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T10:17:13.443

Modified: 2026-10-15T16:32:39.893

Link: CVE-2026-34008

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T18:00:12Z

Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource