{"cve":"CVE-2020-2500","nvd":{"published":"2020-07-01T16:15:13.073","modified":"2026-06-17T03:12:14.317","status":"Modified","description":"This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5},"cwes":["CWE-798","CWE-284","CWE-321"],"references":["https://www.qnap.com/zh-tw/security-advisory/qsa-20-03","https://www.qnap.com/zh-tw/security-advisory/qsa-20-03"],"products":["qnap:helpdesk"],"source":"nvd","synced_at":"2026-10-19T21:06:22.076270124+00:00"},"epss":{"cve":"CVE-2020-2500","score":0.00745,"percentile":0.54806,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}