A missing authorization vulnerability exists in the ACL API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to read or write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 5.4.