CVE-2026-22624 Missing authorization in HS-AFS-S1H1
Authenticated users can manipulate other users' files due to inadequate access control in HIKSEMI NAS products.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22624?
CVE-2026-22624 is a medium-severity missing authorization vulnerability in HIKSEMI HS-AFS-S1H1, published on 30 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization.
Weakness: CWE-863
Which versions are affected by CVE-2026-22624?
How do I fix CVE-2026-22624?
No fix has been published for CVE-2026-22624 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-22624 being exploited?
There is no known exploitation of CVE-2026-22624 in the wild and no public exploit code.
Sources
Also known as GHSA-3737-xm99-hq62.