# CVE-2026-44083: QNAP QuMagie authorization bypass via user-controlled key

Source: https://junglewise.ai/threats/cve-2026-44083-qnap-qumagie-authorization-bypass-via-user-controlled-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44083 · Severity: info · CVSS 8.7 · Published 2026-06-09

An authorization bypass vulnerability has been identified in QuMagie, a photo management application for QNAP NAS devices. This flaw allows remote attackers to gain unauthorized access to the system and obtain elevated privileges. Exploitation could lead to the exposure of private media files and sensitive user data stored on the device.

Vendors: [QNAP Systems, Inc.](https://junglewise.ai/threats/vendors/qnap-systems-inc).

## Quick answers

**Is CVE-2026-44083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44083 being exploited in the wild.

**How severe is CVE-2026-44083?** Informational severity, with a CVSS score of 8.7, published 9 June 2026.

**Which products and versions are affected?** QNAP Systems, Inc. QuMagie Versions prior to 2.9.1.

**Is there a fix for CVE-2026-44083?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44083 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44083?** Check whether you run QNAP Systems or Inc. QuMagie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability (CWE-639) involves an authorization bypass through a user-controlled key in QNAP QuMagie. The flaw allows a remote, unauthenticated attacker to manipulate keys or identifiers within requests to bypass security checks. By successfully exploiting this, an attacker can gain unintended privileges, potentially accessing data belonging to other users. The vulnerability is reachable over the network without user interaction. QNAP has addressed this issue in QuMagie version 2.9.1 and later.

## Affected products

- QNAP Systems, Inc. QuMagie Versions prior to 2.9.1

## Timeline

- 2026-06-09: advisory: QNAP security advisory QSA-26-35 published
- 2026-06-09: disclosed: CVE-2026-44083 published to NVD

## References

- [https://www.qnap.com/en/security-advisory/qsa-26-35](https://www.qnap.com/en/security-advisory/qsa-26-35)

## Related threats

- [QNAP QuMagie missing authorization](https://junglewise.ai/threats/cve-2026-26236-qnap-qumagie-missing-authorization)