EUVD-2026-41401
GHSA-66wx-hp59-23gx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable API with low complexity and no interaction, but a valid low-privileged account is required (PR:L); successful escalation yields full application-level C/I/A impact within an unchanged scope.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.
AnalysisAI
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, network-adjacent user to gain elevated privileges within the controller due to Improper Access Control (CWE-284). Tagged as an authentication/authorization bypass and reported via HackerOne, the flaw carries a CVSS 8.8 with full confidentiality, integrity, and availability impact once triggered. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
UniFi Network Application is Ubiquiti's centralized controller software for managing UniFi networking gear (access points, switches, gateways), typically self-hosted on a UniFi OS Console, Cloud Key, or a Linux/Windows server, and exposing a web-based management portal with role-based accounts (e.g. read-only, limited admin, super admin). The root cause is CWE-284 Improper Access Control: an authorization check is missing or inadequately enforced on a privileged operation, so an account holding low-level access is not properly constrained from performing actions reserved for higher-privileged roles. Because the CVSS vector is AV:N with S:U, the flaw is exploited over the network against the application itself without crossing a trust/scope boundary - the attacker simply elevates their own role or capabilities inside the same application. The affected CPE is cpe:2.3:a:ubiquiti_inc:unifi_network_application (all versions per the wildcard), meaning the specific fixed build must be read from the vendor advisory rather than the CPE string.
RemediationAI
Apply the fixed release identified in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the input does not contain an exact fix version number, so treat this as 'Patch available per vendor advisory' and confirm the specific patched build against that bulletin before deployment. Until patched, reduce exposure by auditing and removing unnecessary low-privileged and limited-admin accounts, since exploitation requires a valid low-privilege account (removing that foothold removes the attack surface, at the cost of revoking legitimate delegated access). Additionally restrict network reachability of the controller's management interface to trusted management VLANs or VPN only and enforce strong, unique credentials plus MFA on all accounts to limit who can obtain the low-privileged foothold; the trade-off is added operational friction for legitimate remote administrators. On UniFi OS Consoles/Cloud Keys, enable automatic updates so the fixed firmware/controller build is pulled as soon as it is available.
More in Unifi Network Application
View allPrivilege escalation in Ubiquiti's UniFi Network Application allows an already-authenticated, high-privileged user with
Authenticated command injection in Ubiquiti's UniFi Network Application (the controller software managing UniFi network
A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems
Privilege escalation via path traversal in self-hosted UniFi Network Application (Ubiquiti's controller software) allows
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, authenticated user on the network
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (V
Privilege persistence in Ubiquiti's UniFi Network Application allows a low-privileged network-adjacent actor to retain g
Denial of service in Ubiquiti's UniFi Network Application allows a remote, unauthenticated attacker with network access
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. Rated
A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today