EUVD-2026-41390
GHSA-q2c2-qqhg-wj5p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable app requiring only a low-privileged account (PR:L), no user interaction; SQLi escalates from app into host, justifying S:C with full host CIA impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Ubiquiti's UniFi Talk Application allows an authenticated attacker holding a low-privileged account to chain multiple SQL injection flaws (CWE-89) and gain elevated control over the underlying host device. The issue carries a critical 9.9 CVSS score driven by network reachability, low attack complexity, and a scope change from the application into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low bar of only needing minimal authenticated access makes this a high-priority patch for exposed UniFi Talk deployments.
Technical ContextAI
UniFi Talk is Ubiquiti's VoIP/telephony application that runs as part of the UniFi ecosystem (typically on UniFi OS Consoles/Cloud Keys or self-hosted controllers) and stores call, contact, and configuration state in a backend database. The vulnerability class is CWE-89 (SQL Injection): user-controllable input reaches SQL statements without proper parameterization, letting an authenticated actor alter query logic. Per the affected CPE (cpe:2.3:a:ubiquiti_inc:unifi_talk_application:*:*:*:*:*:*:*:*), the flaw is in the application layer itself. Because the injection is described as a 'series' of authenticated SQLi issues that ultimately escalate privileges on the host device, the database context is trusted enough that query manipulation translates into host-level control - consistent with the CVSS scope-change flag (S:C).
RemediationAI
Patch available per vendor advisory: update the UniFi Talk Application to the fixed version described in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the input does not include an exact fixed version number, so verify the target build directly from that advisory. Until patched, reduce exposure by restricting network access to the UniFi Talk application/console to trusted management networks or VPN only (trade-off: remote/roaming phone features may break), and tighten account provisioning so that only trusted users hold even low-privileged Talk accounts, since exploitation requires an authenticated session (trade-off: added onboarding friction). Because the flaw enables host-level privilege escalation, also review and rotate credentials on any console that may have been exposed to untrusted low-privileged users.
More in Unifi Talk Application
View allRemote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands
Privilege escalation in Ubiquiti's UniFi Talk Application allows a low-privileged, network-adjacent user to gain elevate
Server-Side Request Forgery in Ubiquiti's UniFi Talk Application allows a network-positioned attacker to coerce the appl
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today