EUVD-2026-41403
GHSA-7228-x566-c73m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable app with low-privilege account required (PR:L, AV:N, AC:L, UI:N); privilege escalation yields high confidentiality and integrity impact but no availability effect, scope unchanged.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalate privileges within the UniFi Talk Application.
AnalysisAI
Privilege escalation in Ubiquiti's UniFi Talk Application allows a low-privileged, network-adjacent user to gain elevated privileges within the application through an improper access control (CWE-284) weakness, tracked as CVE-2026-55119 and rated CVSS 8.1. Ubiquiti tagged the issue as an Authentication Bypass, and a successful attack yields high confidentiality and integrity impact (C:H/I:H) over an existing authenticated session without any user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
UniFi Talk is Ubiquiti's VoIP/telephony application that runs as an app within the UniFi ecosystem (typically hosted on a UniFi OS Console or gateway), providing softphone, call routing, and phone-system management for organizations. The single affected product is identified by CPE cpe:2.3:a:ubiquiti_inc:unifi_talk_application:*:*:*:*:*:*:*:*, with no upper version boundary published in the provided data. The root cause is CWE-284 (Improper Access Control): the application fails to correctly enforce authorization boundaries between privilege levels, so an actor who already holds a low-privilege role can perform actions or reach resources reserved for higher-privilege roles. Ubiquiti's 'Authentication Bypass' tag indicates the enforcement gap sits in the app's identity/authorization layer rather than in an underlying transport or OS control.
RemediationAI
Patch available per vendor advisory: update the UniFi Talk Application to the fixed release described in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the exact fixed version is not enumerated in the provided data, so consult that advisory and apply the update through the UniFi application/console update mechanism. Until the patch is applied, reduce exposure by restricting who holds low-privilege Talk accounts and auditing existing user roles, since exploitation requires a valid low-privilege login - remove or disable unnecessary or shared low-tier accounts (trade-off: may interrupt legitimate limited users). Additionally, limit network reachability of the UniFi Talk management interface to trusted VLANs or management subnets and place the console behind VPN rather than exposing it broadly (trade-off: remote/off-site users lose direct access and must connect through VPN). Monitor Talk application and UniFi OS logs for unexpected privilege or configuration changes as a detective control.
More in Unifi Talk Application
View allRemote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands
Privilege escalation in Ubiquiti's UniFi Talk Application allows an authenticated attacker holding a low-privileged acco
Server-Side Request Forgery in Ubiquiti's UniFi Talk Application allows a network-positioned attacker to coerce the appl
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today