QNAP Video Station: Authorization bypass via user-controlled key
Summary
QNAP Video Station on QNAP NAS devices contains an authorization bypass caused by a user-controlled key. According to the CNA, a remote attacker can obtain sensitive data, such as media of other users, by manipulating a key value. The CNA rates the attack as requiring no privileges and no user interaction, but the exact preconditions are not documented in the sources and other sources score it differently.
Affected
- Video Station 5.8.x before 5.8.8 (per CNA record)
- VulDB describes the range as up to 5.8.7
- Whether 5.7.x or older releases are affected: Unknown.
Fixed in
- Video Station 5.8.8 and later
Workaround
Unknown. No vendor-documented workaround found. Until the update is installed, restrict Video Station access from the internet with a VPN or firewall rule.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in the CISA KEV catalog.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- EPSS score 0.00412 (low).
- VulDB shows a 0-Day label; this is unconfirmed and not verified as exploitation.
- No public proof-of-concept found in searches; this does not prove that none exists.
Our recommendation
- Inventory all QNAP NAS devices with Video Station and record their versions.
- Update Video Station to 5.8.8 or later and check the QNAP PSIRT site for the official advisory.
- Confirm that no Video Station port is exposed to the internet; if it is, restrict it until patched.
- Review Video Station access logs for unusual access to other users' media (generic check; no published indicators of compromise).
- Ensure strong passwords and remove unused user accounts, since the related path traversal issue CVE-2026-34015 requires a valid account.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP Video Station release notes www.qnap.com
- VulDB entry CVE-2026-44084 vuldb.com
- OpenCVE CVE-2026-44084 app.opencve.io
- Vulners CVELIST CVE-2026-44084 vulners.com
- ThreatInt CVE-2026-44084 cve.threatint.com
- EUVD-2026-101976 (CVE-2026-34015) vulners.com
- NVD CVE-2021-44055 nvd.nist.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:32.
Original description (NVD)
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.