Read the docs
TI-2023-29267 Aliases CVE-2023-52947GHSA-56mf-38rx-qwp9

Missing authentication in Synology Active Backup for Business Agent

Priority LOW 18CWE-306Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logout.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Fix Fixed Synology Active Backup for Business Agent (Synology): 2.7.0-3221

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SynologySynology Active Backup for Business Agentbefore 2.7.0-32212.7.0-3221Patch availableCNA
  • Synology Active Backup for Business Agent VendorSynology Affected before 2.7.0-3221 Fixed in 2.7.0-3221 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synology:active_backup_for_business_agent:*:*:*:*:*:*:*:*before 2.6.0-3101VulnerableSynology
  • cpe:2.3:a:synology:active_backup_for_business_agent:*:*:*:*:*:*:*:* Versions before 2.6.0-3101 Vulnerable ·Synology

Remediation

  • Fix · CNA Synology Active Backup for Business Agent (Synology) Fixed in 2.7.0-3221

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Synology Active Backup for Business Agent — Synology-SA-24:11 Synology Active Backup for Business Agent

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2023-29269 Missing authentication in Synology Active Backup for Business AgentPriority LOW 26
    • TI-2023-29270 Missing encryption of sensitive data vulnerability in login component in Synology Active…Priority LOW 25
    • TI-2023-29268 Missing encryption of sensitive data vulnerability in settings functionality in Synology…Priority LOW 23
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-52947
  2. 2026-10-03 Alias added: GHSA-56mf-38rx-qwp9

References

Advisory 1

  • TI-2024-31599 Path traversal in Synology Active Backup for Business CVSS 3.1MEDIUM 6.5
  • TI-2024-31600 Improper limitation of a pathname to a restricted directory ('Path Traversal')… CVSS 3.1MEDIUM 6.5
  • TI-2025-40996 Origin validation error in Synology Active Backup for Business Agent CVSS 3.1MEDIUM 6.1
  • TI-2023-29269 Missing authentication in Synology Active Backup for Business Agent CVSS 3.1MEDIUM 5.5
  • TI-2023-29270 Missing encryption of sensitive data vulnerability in login component in Synology Active… CVSS 3.1MEDIUM 5.3
  • TI-2023-29268 Missing encryption of sensitive data vulnerability in settings functionality in Synology… CVSS 3.1MEDIUM 5.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences