UniFi Talk CVE-2026-55113

Exploitation requires network access to a host running the UniFi Talk Application and the ability to reach its API/service endpoints; no authentication is required per the CVSS vector (PR:N) and no user interaction is needed (UI:N). The specific prerequisite is that UniFi Talk must be deployed and network-reachable by the attacker - i.e., the telephony application is installed and its endpoints are exposed to the attacker's network segment. Limiting factors: attack complexity is High (AC:H), meaning the attacker likely needs additional conditions such as knowledge of internal target endpoints, specific request crafting, or favorable timing to succeed; the vulnerability yields only integrity (auth bypass, I:L) and availability (DoS, A:H) impact with no confidentiality exposure (C:N). Deployments where the UniFi Talk host is confined to a trusted management VLAN or not internet-exposed substantially reduce reachable attack surface.

The signals are mixed and warrant a moderate-to-elevated but not top-tier priority. In favor of urgency: the vector is network-reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N), the scope is changed (S:C), and the impact includes high availability loss plus an authentication bypass. Tempering this: attack complexity is High (AC:H), implying non-trivial preconditions or timing/knowledge the attacker must satisfy, and confidentiality impact is explicitly None (C:N) - this is a disruption-and-access-control issue, not data exfiltration. No EPSS score was provided, so exploitation probability cannot be quantified. It is not in CISA KEV and no POC was referenced, so there is no public exploit identified at time of analysis. Net: a credible remotely-exploitable weakness whose real-world exploitation is bounded chiefly by AC:H and the relatively niche deployment of UniFi Talk. Note a mild internal tension worth verifying with the vendor: the description frames the DoS and auth-bypass as the primary outcomes, while SSRF (CWE-918) is often a stepping-stone to internal resource access - the advisory should be reviewed to confirm the full impact surface.

An attacker with network access to the UniFi Talk host sends crafted requests that manipulate a server-side URL/host parameter, causing the application to issue attacker-directed internal requests. By abusing this SSRF the attacker reaches protected UniFi Talk API endpoints to bypass authentication and/or drives the service into a resource-exhaustion condition, taking telephony offline (DoS). No public exploit is identified at time of analysis, and the High attack complexity means the attacker likely needs specific knowledge of internal endpoints or timing to succeed reliably.