CVE-2026-44084 is an authorization bypass through a user-controlled key in QNAP Video Station. The record scores it 7.5 (High). QNAP says remote attackers could obtain sensitive data with no account needed. QNAP has fixed it in Video Station 5.8.8 and later, and the update comes through the App Center.
What's affected
QNAP's wording in the CVE record is that the issue is fixed in Video Station 5.8.8 and later, so earlier versions of the app are affected. The vector in the record is network, no privileges, no user interaction, with high confidentiality impact only.
The QNAP release notes page we fetched did not render any entries, so we could not confirm the fix from the release notes themselves. The fixed version below comes from the vendor's wording in the CVE record. Open the QNAP security advisory for this CVE and the App Center before relying on it.
Weakness class: CWE-639, authorization bypass through user-controlled key. It was published together with two SQL injection CVEs for the same app, CVE-2026-26244 and CVE-2026-26245.
How to check if you're exposed
Open App Center on the NAS and read the installed Video Station version. Below 5.8.8 means affected. If the app is not installed, the flaw does not apply.
Then ask whether the NAS is reachable from outside. Because this flaw needs no account, internet reachability is the deciding factor. Check your router for port forwards to the NAS, and in QTS look at the myQNAPcloud settings to see whether remote access is switched on. Review the access logs for unfamiliar addresses requesting media content.
What to do now
- Update Video Station to 5.8.8 or later in App Center on every NAS.
- Uninstall Video Station if nobody uses it.
- Take NAS app ports off the internet and require a VPN for remote access.
- Review which shares and libraries Video Station can read, and reduce them to what is needed.
- Update the two related SQL injection CVEs in the same maintenance window.
Why it matters
A user-controlled key means the app looks up an object, such as a file or record, using an identifier the caller supplies, and does not check that the caller is allowed to see that object. It is a form of insecure direct object reference, and it is one of the most common authorization mistakes in web applications.
Here the record says remote attackers could obtain sensitive data without logging in. A media app often has access to personal photos, videos and file paths, and on a NAS it may be able to read more than the user realised. The KEV flag is false and QNAP does not report exploitation. The fix is a plain update, so there is little reason to wait.
Quick check
Is a login required?
The record's vector requires no privileges, so no account is needed.
What does the attacker get?
The record says sensitive data, with high confidentiality and no integrity or availability impact.
Sources
Last reviewed: 18 October 2026.
