This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service.

Published 6 y ago 2020-07-01 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.7%

percentile 55%

Public exploits

none known

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.

Exploit prediction (EPSS)

0.74% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`
NVD	2.0	6.4	`AV:N/AC:L/Au:N/C:P/I:P/A:N`

Affected products

QNAP Systems Inc. Helpdesk

Classification

Weakness

CWE-284 Improper Access Control
CWE-321 Use of Hard-coded Cryptographic Key
CWE-798 Use of Hard-coded Credentials

References

qnap.com /zh-tw/security-advisory/qsa-20-03 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2020-2500
NVD: CVE-2020-2500

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.