UniFi OS CVE-2026-55110

Requires a UniFi OS user to be actively authenticated to the console and to be lured (UI:R) into visiting an attacker-controlled web page in the same browser while that session is valid; the attacker themselves needs no credentials (PR:N) but must satisfy the CORS misconfiguration to have their malicious origin trusted for credentialed requests, and AC:H indicates non-trivial conditions such as timing against a live session or a permitted/reflected origin. Limiting factors that reduce real-world risk: the victim must already be logged in and must click through to the malicious page, the console UI must be reachable from the victim's browser (network exposure), and the attack cannot proceed against a logged-out admin or a console not currently in use - it is not exploitable purely remotely against a default install without a human victim.

Signals are mixed and point to a real-but-conditional risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) shows network reach and no attacker authentication, but two dampeners: AC:H (attacker must win a race/meet non-trivial conditions such as a valid trusted-origin reflection and an active session) and UI:R (a logged-in admin must be lured to a malicious page). No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or automated exploitation - this reads as opportunistic/targeted social-engineering rather than mass exploitation. The high C/I/A ratings reflect that a successful attack runs with full operator privilege against a network's core gateway, which is a serious blast radius; however, the dependency on an authenticated victim and the vendor's confidential HackerOne-sourced disclosure (no weaponized details public) keep the practical near-term likelihood moderate. Missing data to note explicitly: no EPSS and no KEV data were supplied, and no exact fixed version is in the input - patch presence is inferred solely from the referenced UI security bulletin.

An attacker sends a UniFi administrator a phishing link (e.g., a fake support or firmware-notice page) while that admin is logged into their UniFi OS console in another tab. The malicious page runs JavaScript that, thanks to the permissive CORS policy, makes credentialed cross-origin requests to the console API and reads the responses and/or triggers configuration actions under the admin's identity. No public exploit is identified at time of analysis, and success requires the victim's active session plus the attacker meeting the CORS trust conditions (AC:H).