CVE-2022-22686: Synology Calendar

High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days.

Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.

Affected products

• Synology Calendar: before 2.3.4-0631 (fixed in 2.3.4-0631)

Published 2022-07-26. Last modified 2026-06-17.