Samba: Authenticated users can change other users' password

Good news: Only affects the AD / LDAP component. Bad news: That component is enabled by default. Good news: If you don't use Samba LDAP, an effective mitigation is to just disable the ldap service (search the fine article for "Disable LDAP").

Does synology use samba for SMB drives?

This is pretty major and can go right in your exploiter's toolbag for privilege escalation scenarios.

This does not apply when the Samba server is a domain member instead of domain controller, right?

Haven't used samba much; this is enlightening. Previously I had assumed it just used the same auth system (e.g. PAM) as the host. That would entail its own complications but would probably have prevented this bug.