CVE-2023-51065 is a high severity (CVSS 7.5) incorrect access control flaw in QStar Archive Solutions Release 3-0 Build 7 Patch 0. Unauthenticated attackers can obtain system backups and other sensitive information. The record names no fix, so contact QStar and restrict network access.
What's affected
The NVD record lists QStar Archive Solutions (Archive Storage Manager) Release 3-0, Build 7, Patch 0 as affected. The description says incorrect access control allows unauthenticated attackers to obtain system backups and other sensitive information from the QStar Server.
The record names no fixed release, and the only reference is a researcher write-up on GitHub that I did not load. Check with QStar for a patched build and ask for their advisory.
CVSS for this entry is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
How to check if you're exposed
Look in the product's about or system information page for the release string. A match on Release 3-0 Build 7 Patch 0 means you are in scope of the record. Because backups may hold configuration and credentials, treat any backup file the server could have served as potentially read, and rotate secrets stored there.
Because the record lists no CWE-specific fix guidance, the most useful check is network reachability: can systems outside your storage administration network reach the QStar server's web service?
What to do now
- Identify QStar Archive Solutions servers and confirm the release, build and patch level.
- Ask QStar whether a build newer than Build 7 Patch 0 fixes this CVE, and apply it when available.
- Restrict network access to the QStar web interface and services to the administrators and systems that need them.
- Review the server's access logs and configuration for changes you did not make, then record the outcome.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-284 is improper access control. A function that should require authorization can be reached by someone who has not been granted it. The fix is to enforce authentication and authorization on every sensitive endpoint, not just on the pages that link to it.
The weakness is CWE-284, improper access control. The NVD vector shows network access, no privileges, no interaction and a high confidentiality impact only. Backups often contain account data and configuration, which is why this class of flaw is valued by attackers.
Neither the record nor any source I read reports exploitation.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
What is exposed?
System backups and other sensitive information from the QStar server, per the description.
What should I rotate?
Credentials and keys that appear in your QStar backups or configuration, as a precaution.
Sources
Last reviewed: 19 October 2026.
