Auth API: denial of service

Synology DiskStation Manager (DSM)

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Do this now

Upgrade DSM to 7.4.1-90080-1, 7.3.2-86009-5, or 7.2.2-72806-10 (+1 more lines in Fix it).

Who should check: teams running Homelab apps

Fix it

DiskStation Manager (DSM)

On 7.2.1.xUpgrade to DiskStation Manager (DSM) 7.2.1-69057-13
On 7.2.2.xUpgrade to DiskStation Manager (DSM) 7.2.2-72806-10
On 7.3.2.xUpgrade to DiskStation Manager (DSM) 7.3.2-86009-5
On 7.4.1.xUpgrade to DiskStation Manager (DSM) 7.4.1-90080-1

First seen: 12 Nov 2026
Last update: 12 Nov 2026, 04:18 UTC
Fixed in: 7.4.1-90080-1
7.3.2-86009-5
7.2.2-72806-10
7.2.1-69057-13
Identifiers: CVE-2026-76954
CVSS: 9.8
Source: news
On the menu as: Homelab apps

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Auth API: denial of service
Severity: critical. Patch status: patched.
Affected: Synology DiskStation Manager (DSM)
Fixed in: 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, 7.2.1-69057-13
Ids: CVE-2026-76954

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

## Steps
1. This touches infrastructure (self-hosted). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: DiskStation Manager (DSM): 7.4.x → 7.4.1-90080-1; 7.3.x → 7.3.2-86009-5; 7.2.x → 7.2.2-72806-10; 7.2.x → 7.2.1-69057-13.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| DiskStation Manager (DSM) 7.4.x | fixed | 7.4.1-90080-1 | — |
| DiskStation Manager (DSM) 7.3.x | fixed | 7.3.2-86009-5 | — |
| DiskStation Manager (DSM) 7.2.x | fixed | 7.2.2-72806-10 | — |
| DiskStation Manager (DSM) 7.2.x | fixed | 7.2.1-69057-13 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-76954") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-76954 https://www.synology.com/en-global/security/advisory/Synology_SA_26_19
https://pwned.coffee/i/auth-api-denial-of-service-cve-2026-76954

Timeline

12 Nov 2026, 04:18 UTC
Fix status: unknown → patched.
12 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
DiskStation Manager (DSM) 7.4.1 to before 7.4.1-90080-1 7.4.1-90080-1 CVE record (CNA) checked 13 Nov
DiskStation Manager (DSM) 7.3.2 to before 7.3.2-86009-5 7.3.2-86009-5 CVE record (CNA) checked 13 Nov
DiskStation Manager (DSM) 7.2.2 to before 7.2.2-72806-10 7.2.2-72806-10 CVE record (CNA) checked 13 Nov
DiskStation Manager (DSM) 7.2.1 to before 7.2.1-69057-13 7.2.1-69057-13 CVE record (CNA) checked 13 Nov
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA synology) for CVE-2026-76954
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
DiskStation Manager (DSM)	7.4.1 to before 7.4.1-90080-1	7.4.1-90080-1	CVE record (CNA) checked 13 Nov
DiskStation Manager (DSM)	7.3.2 to before 7.3.2-86009-5	7.3.2-86009-5	CVE record (CNA) checked 13 Nov
DiskStation Manager (DSM)	7.2.2 to before 7.2.2-72806-10	7.2.2-72806-10	CVE record (CNA) checked 13 Nov
DiskStation Manager (DSM)	7.2.1 to before 7.2.1-69057-13	7.2.1-69057-13	CVE record (CNA) checked 13 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee