EUVD-2026-41397
GHSA-f3pc-vh4r-hxxh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Network-reachable but requires a low-privilege account (PR:L) and the description's 'certain conditions' warrants AC:H; impact is escalation with high integrity/availability but only low confidentiality.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.
AnalysisAI
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, authenticated user on the network to elevate their permissions within the application by abusing an Improper Access Control weakness (CWE-284). The CVSS 3.1 score of 8.3 reflects that a network-reachable actor holding limited credentials can, under certain conditions, gain high integrity and availability impact over the controller. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Ubiquiti has published Security Advisory Bulletin 066 addressing it.
Technical ContextAI
UniFi Network Application is Ubiquiti's centralized controller software (formerly the UniFi Controller) used to provision, monitor, and manage UniFi access points, switches, gateways, and other network devices, typically exposed over a web/management interface. The root cause is CWE-284 Improper Access Control: the application fails to correctly enforce authorization boundaries between privilege tiers, so an account that should be restricted to a low-privilege role (e.g., a limited operator or read-only administrator) can reach functionality reserved for higher roles. The vendor and community tagging as 'Authentication Bypass' indicates the flaw undermines the role/permission checks rather than a memory-safety or injection issue. The single CPE, cpe:2.3:a:ubiquiti_inc:unifi_network_application:*:*:*:*:*:*:*:*, is version-agnostic, meaning the affected version boundary is not encoded in NVD data and must be read from the vendor advisory.
RemediationAI
Upgrade the UniFi Network Application to the fixed release identified in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the exact patched version number was not included in the provided data and should be confirmed directly from that advisory. Because exploitation requires an authenticated low-privilege account, interim compensating controls include auditing and pruning controller user accounts and delegated-admin/limited-role assignments, tightening who holds any account on the controller, and restricting network reachability of the management interface to trusted administrative networks or VPN (which limits the AV:N exposure but does not remove risk from legitimate low-privilege insiders). Rotating credentials and enabling MFA on controller accounts reduces the chance an attacker obtains the required low-privilege foothold; none of these workarounds substitute for the patch, so upgrading remains the primary fix.
More in Unifi Network Application
View allPrivilege escalation in Ubiquiti's UniFi Network Application allows an already-authenticated, high-privileged user with
Authenticated command injection in Ubiquiti's UniFi Network Application (the controller software managing UniFi network
A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, network-adjacent user to gain elev
Privilege escalation via path traversal in self-hosted UniFi Network Application (Ubiquiti's controller software) allows
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (V
Privilege persistence in Ubiquiti's UniFi Network Application allows a low-privileged network-adjacent actor to retain g
Denial of service in Ubiquiti's UniFi Network Application allows a remote, unauthenticated attacker with network access
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. Rated
A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today