CVE-2026-9491 - A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information

Back Back to CVE browser

MEDIUM

A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information

Published Aug 28, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.

Affected products

Vendor Synology Product Synology Chat Server Default
affected
- Version
  -
  Status
  affected
  Constraints
  <2.4.5-22148

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Synology

Synology Chat Server

affected

Version	Status	Constraints
-	affected	<2.4.5-22148

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67462
Advisory
https://www.synology.com/en-global/security/advisory/Synology_SA_26_10
vendor-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67462		Advisory
https://www.synology.com/en-global/security/advisory/Synology_SA_26_10		vendor-advisory