EUVD-2026-41402
GHSA-fhjm-rpqj-xm7m
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires prior low-privilege authenticated access (PR:L) and a specific stale-authorization condition (AC:H) over the network (AV:N); retained privileges grant full control of managed network, so C/I/A all High.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Application to persist privileges within UniFi Network Application after such access had been removed.
AnalysisAI
Privilege persistence in Ubiquiti's UniFi Network Application allows a low-privileged network-adjacent actor to retain granted privileges within the controller even after those privileges are supposed to have been revoked, due to an Incorrect Authorization (CWE-863) flaw. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N) with high confidentiality, integrity, and availability impact, meaning an actor whose access was removed can continue to act with the old authorization. No public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires prior authenticated access plus specific unstated conditions (AC:H).
Technical ContextAI
The UniFi Network Application is Ubiquiti's centralized software controller used to provision, monitor, and manage UniFi networking hardware (access points, switches, gateways/UDM devices) and their associated administrator/user roles. The root cause is CWE-863 (Incorrect Authorization): the application makes an access-control decision but applies the wrong policy or fails to fully invalidate an authorization state, so a privilege or role that has been administratively removed is not consistently enforced across the controller's session or object-permission model. The affected CPE is cpe:2.3:a:ubiquiti_inc:unifi_network_application (all versions in NVD data until the fixed release), indicating the flaw is in the management application layer rather than device firmware. In practical terms, the authorization check that should recognize 'this account/actor no longer has these privileges' returns a stale or incorrect result, allowing continued privileged action.
RemediationAI
Upgrade the UniFi Network Application to the fixed version identified in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); Patch available per vendor advisory, though the exact patched version string is not included in the provided data and must be read from that bulletin before deployment. Until patched, reduce exposure by tightly controlling who holds any administrative or delegated role in the controller and by auditing account/role assignments - specifically, after revoking a user's access, force-terminate active sessions and restart or re-authenticate the controller to invalidate any stale authorization state (trade-off: session restarts briefly interrupt admin workflows). Additionally, restrict network reachability of the UniFi Network Application management interface to trusted management VLANs or a VPN so that AV:N reachability is limited to vetted operators (trade-off: remote admins must connect through the VPN), and closely monitor admin audit logs for actions taken by accounts whose privileges were recently removed.
More in Unifi Network Application
View allPrivilege escalation in Ubiquiti's UniFi Network Application allows an already-authenticated, high-privileged user with
Authenticated command injection in Ubiquiti's UniFi Network Application (the controller software managing UniFi network
A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, network-adjacent user to gain elev
Privilege escalation via path traversal in self-hosted UniFi Network Application (Ubiquiti's controller software) allows
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, authenticated user on the network
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (V
Denial of service in Ubiquiti's UniFi Network Application allows a remote, unauthenticated attacker with network access
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. Rated
A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today