# CVE-2025-58468: QNAP Notification Center CSRF in 1.10.x

Source: https://junglewise.ai/threats/cve-2025-58468-qnap-notification-center-csrf-in-1-10-x  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2025-58468 · Severity: info · CVSS 5.1 · Published 2026-06-10

A security vulnerability has been identified in QNAP Notification Center, a tool used to manage system alerts and notifications on QNAP NAS devices. An attacker could trick a logged-in user into performing unintended actions, potentially allowing the attacker to gain unauthorized privileges or hijack the user's identity. This could lead to unauthorized changes to system notification settings or broader access to the device management interface.

Vendors: [QNAP Systems, Inc.](https://junglewise.ai/threats/vendors/qnap-systems-inc).

## Quick answers

**Is CVE-2025-58468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-58468 being exploited in the wild.

**How severe is CVE-2025-58468?** Informational severity, with a CVSS score of 5.1, published 10 June 2026.

**Which products and versions are affected?** QNAP Systems, Inc. Notification Center 1.10.x prior to 1.10.0.3291.

**Is there a fix for CVE-2025-58468?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-58468 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-58468?** Check whether you run QNAP Systems or Inc. Notification Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site request forgery (CSRF) vulnerability (CWE-352) exists in QNAP Notification Center versions 1.10.x. The flaw allows a remote attacker to execute unauthorized actions in the context of a victim's browser session, provided the victim is authenticated to the QNAP management interface and interacts with a malicious link or site. Successful exploitation can lead to privilege escalation or session hijacking. The vulnerability is addressed in Notification Center version 1.10.0.3291 and later.

## Affected products

- QNAP Systems, Inc. Notification Center 1.10.x prior to 1.10.0.3291

## Timeline

- 2026-03-10: advisory: Initial advisory published by QNAP (QSA-26-13)
- 2026-06-10: disclosed: NVD publication date

## References

- [https://www.qnap.com/en/security-advisory/qsa-26-13](https://www.qnap.com/en/security-advisory/qsa-26-13)