CVE-2026-2237

Medium

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before…

synology·CWE-598·Published 2026-05-27

CVSS

5.5

EPSS

0.00

KEV

Exploits

Vendor statements (1)

synology.com

cve.orgen

208 chars

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	6.2	—	—	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	NVD	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	6.2	2.5	3.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N