CVE-2026-44083 is a critical authorization bypass (CVSS 9.8) in QNAP QuMagie, the photo management app for QNAP NAS devices. Remote attackers can gain unintended privileges. QNAP fixed it in QuMagie 2.9.1 and later, so update the app on every NAS that runs it.
What's affected
QNAP's record says the fix is in QuMagie 2.9.1 and later. It does not list the exact affected range, so treat earlier versions as affected.
The advisory is QSA-26-35 on the QNAP site. I could not retrieve its text.
How to check if you're exposed
On each NAS, open the App Center, find QuMagie and read the installed version. If it is below 2.9.1, it is exposed.
Also check whether the NAS is reachable from the internet, through port forwarding, myQNAPcloud or a public IP. Network attached storage on the open internet is a frequent target.
What to do now
- Update QuMagie to 2.9.1 or later from the App Center.
- If you do not use QuMagie, uninstall it.
- Remove direct internet exposure of the NAS and use a VPN for remote access.
- Review user accounts and sharing on the NAS, and change passwords if you see anything odd.
- Read QSA-26-35 for any further guidance.
Why it matters
The weakness is CWE-639, authorization bypass through a user controlled key. The app uses an identifier supplied by the user to decide what they can reach, without checking that they own it. Changing the identifier opens other people's data or functions.
The vector has no login and no user action, which explains the 9.8 score. The KEV flag is false, and I found no claim of exploitation.
Quick check
What version is safe?
QNAP says QuMagie 2.9.1 and later contain the fix.
Sources
Last reviewed: 19 October 2026.
