EUVD-2026-41386
GHSA-rwfh-5cw2-f7g6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires existing high app privileges (PR:H) over the network (AV:N) with no user interaction; the application-to-host escalation justifies S:C and full C/I/A impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Ubiquiti's UniFi Access Application allows an attacker who already holds high privileges and network reachability to break out and gain elevated control of the underlying host device. The flaw is an improper access control issue (CWE-284) tagged as an authentication bypass, carrying a CVSS 9.1 (Critical) rating driven largely by its scope-changing impact. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
UniFi Access is Ubiquiti's physical/logical access-control management application (CPE cpe:2.3:a:ubiquiti_inc:unifi_access_application) used to administer door controllers, readers, and access policies. The root cause is CWE-284 (Improper Access Control): the application fails to properly enforce authorization boundaries between the application layer and the underlying host, so an actor operating within the application context can perform actions or reach resources on the host device that should be restricted. The 'Authentication Bypass' tag combined with a Scope:Changed CVSS vector indicates the security authority enforcing separation between the application and the host operating environment is circumvented, letting application-level privileges translate into host-level control.
RemediationAI
Apply the vendor's fixed release for UniFi Access as described in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the exact fixed version is not included in the provided data, so confirm the target version directly from that advisory before deploying - Patch available per vendor advisory. Until patched, reduce exposure by restricting network access to the UniFi Access management interface to a dedicated management VLAN or trusted admin hosts only, and by minimizing the number of high-privilege UniFi Access accounts since exploitation requires PR:H - note that tightening admin access may disrupt legitimate remote administration and integrations. Given the host-device impact, also monitor and isolate the host running UniFi Access so that a compromise of the application cannot pivot freely into the broader network.
More in Unifi Access Application
View allCommand injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arb
OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run a
Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and networ
Command injection in Ubiquiti's UniFi Access Application lets a low-privileged attacker with network reach run arbitrary
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privileg
Arbitrary file disclosure in Ubiquiti's UniFi Access Application allows a network-adjacent, unauthenticated attacker to
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today