This vulnerability involves the use of the HTTP GET request method with sensitive query strings in the volume encryption feature of Synology Storage Manager versions prior to 1.0.1-1100. Because GET requests can expose sensitive data in URLs, local users on Windows systems may obtain sensitive information unintentionally disclosed through these query strings. The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact.

Local users on Windows systems can obtain sensitive information related to volume encryption due to exposure of sensitive data in GET request query strings. This could lead to unauthorized disclosure of confidential information. There is no indication of integrity or availability impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Synology's advisories for updates. Until a patch is available, restrict local access to trusted users only and avoid exposing the affected Storage Manager versions to untrusted local users.