UniFi Talk Application CVE-2026-55119

The attacker must have network access to the UniFi Talk Application and must already possess a valid low-privilege account within that application (CVSS PR:L; Ubiquiti describes it as an Authentication Bypass / improper access control within the Talk app). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a low-tier session exists escalation is straightforward. The primary limiting factor is that fully unauthenticated or externally anonymous exploitation is not indicated - the attacker needs prior low-level authenticated access to the Talk application, which typically implies an insider, a compromised limited credential, or reachability to a network segment where the UniFi console/Talk service is exposed. The specific vulnerable feature or endpoint is not detailed in the provided data beyond 'escalate privileges within the UniFi Talk Application.'

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 8.1 High) describes a network-reachable, low-complexity attack requiring only low existing privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - a realistic priority for any environment that has multiple user tiers in UniFi Talk. Signals are, however, incomplete: there is no EPSS score, no SSVC decision data, no KEV listing, and no public POC in the provided sources, so the raw CVSS understates uncertainty about real-world exploitation likelihood. The key limiting factor is PR:L - the attacker must already be a provisioned low-privilege user of the Talk application, which narrows the threat to insiders or attackers who have first obtained valid low-tier credentials, rather than fully anonymous internet attackers. This is a genuine escalation risk worth patching promptly, but absent EPSS/KEV evidence it should be treated as elevated-but-not-confirmed-exploited rather than an emergency; the CVSS vector and the vendor 'Authentication Bypass' tag are consistent with each other, so no signal conflict is evident.

An attacker who already holds a low-privilege UniFi Talk account (for example a limited user or a compromised low-tier credential) sends crafted requests over the network to application endpoints whose authorization checks are improperly enforced, elevating their role within the Talk app. With the resulting high-privilege access they can read or alter call configuration, telephony settings, or other users' data. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are needed once valid low-tier access exists.