CVE-2023-50363 is a High severity (CVSS 7.4) incorrect authorization flaw in QNAP QTS and QuTS hero. Authenticated users could bypass intended access restrictions over the network. Update to QTS 5.1.6.2722 build 20240402 or QuTS hero h5.1.6.2734 build 20240414 or later.
What's affected
Products: QNAP QTS and QuTS hero. Affected builds named in the record: QTS 5.1.0.2348 (build 20230325), 5.1.0.2399 (build 20230515), 5.1.0.2418 (build 20230603), and QuTS hero h5.1.0.2409 (build 20230525). Fixed: QTS 5.1.6.2722 build 20240402 and later, and QuTS hero h5.1.6.2734 build 20240414 and later, per QNAP advisory QSA-24-20. NVD published the record on 26 April 2024.
The QNAP advisory page is built with scripts and returned no readable text when I fetched it, so the affected and fixed builds below come from the NVD record, which quotes the advisory.
Severity: the record scores it 7.4 (High), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. I only have the record's score, so I cannot compare it with a separate vendor rating. Note that the description says authenticated users could execute code, while the vector shows limited integrity or availability impact and no confidentiality impact, so the wording and the score do not line up perfectly. Treat the score as the formal rating and the description as a reminder not to ignore it.
The same advisory, QSA-24-20, covers several QTS and QuTS hero issues, including three buffer copy flaws: CVE-2023-50361, CVE-2023-50362 and CVE-2023-50364.
How to check if you're exposed
Check the QTS or QuTS hero firmware version in the web interface, under Control Panel, then System, then Firmware Update. The version and build date show on that page.
Compare it with the fixed builds: QTS 5.1.6.2722 build 20240402 or later, and QuTS hero h5.1.6.2734 build 20240414 or later. If your build is older, treat the NAS as affected. The record lists these older builds explicitly: QTS 5.1.0.2348 (build 20230325), 5.1.0.2399 (build 20230515), 5.1.0.2418 (build 20230603) and QuTS hero h5.1.0.2409 (build 20230525). The advisory may name more builds, so use the version comparison, not an exact match.
Then check whether the NAS web interface or any service on it is reachable from the internet. QNAP devices exposed to the internet are a frequent target in general, so reducing exposure is worth doing whatever the CVE says.
Like any appliance, a NAS does not show up in a dependency scan. Keep it in your asset inventory with its firmware build.
What to do now
- Update QTS to 5.1.6.2722 build 20240402 or later, or QuTS hero to h5.1.6.2734 build 20240414 or later, through Firmware Update in Control Panel.
- Take a backup or snapshot before you update, and read the release notes first.
- Remove the NAS from direct internet exposure. Use a VPN for remote access and turn off UPnP port forwarding.
- Review user accounts on the NAS and remove accounts that are unused, since the attacker needs to be logged in.
- Record the new firmware build in your inventory.
Why it matters
The weakness is CWE-285, improper authorization, and the record also maps it to CWE-863, incorrect authorization. The system checks who you are, but then does not correctly check what you are allowed to do. A logged in user can therefore reach resources or actions that policy meant to keep out of reach.
On a NAS this matters because permission boundaries are the product. Shares, folders and administrative functions depend on them. A flaw here undoes the separation between a regular user and data that belongs to other users or to administrators. The vector shows low impact on each of confidentiality, integrity and availability, but with changed scope, and the combination produces a 7.4.
KEV is false and I found no claim of exploitation. This one differs from CVE-2023-50361, CVE-2023-50362 and CVE-2023-50364, which are buffer copy flaws. After patching, review user and group permissions on the NAS, because an authorization bug may have let someone read more than they should have. The Gold directory and the free scan at gold.safeguard.sh/scan help you track the rest of your exposure.
Quick check
How is this different from the other QNAP issues in the advisory?
The others in this group are buffer copy flaws. This one is about authorization: logged in users bypassing access restrictions.
What should I check after updating?
Review share, folder and group permissions, and the access logs, for anything that looks like a user reaching data outside their role.
Sources
Last reviewed: 19 October 2026.
