UniFi Network Application EUVD-2026-41402

Exploitation requires the actor to already hold, or to have recently held, a low-privilege authenticated role within the UniFi Network Application (CVSS PR:L) and to have network access to the controller (AV:N); the core precondition described is a privilege-revocation event - the actor exploits the flaw to persist privileges after their access 'had been removed.' The AC:H metric and the description's phrase 'under certain conditions' indicate a specific, non-deterministic state (such as an active/cached session or a particular role-change sequence) must exist for the stale authorization to be honored. Limiting factors: the attacker must have been legitimately provisioned access at some point, must reach the controller over the network, and cannot rely on default single-step exploitation - this is a former/insider-actor scenario rather than remote-unauthenticated compromise.

This is a moderately severe issue best treated as a real but conditional risk rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, base 7.5) shows the attacker needs network access and existing low-level privileges (PR:L, so authenticated) and must satisfy high attack complexity (AC:H) - the description's 'under certain conditions' aligns with AC:H, confirming exploitation is not trivial or fully deterministic. The C:H/I:H/A:H impact reflects that retained privileges can compromise the managed network's confidentiality, integrity, and availability. No EPSS score, no SSVC decision data, and no POC were provided, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation. The most notable signal tension is that this is a privilege-persistence/retention flaw (an insider or former-access scenario) rather than a remote-unauthenticated takeover, which typically limits real-world exploitation to environments where an actor's access was recently revoked. Missing data: EPSS and any independent confirmation of exploitation status - treat exploitability as low-to-moderate absent those signals.

A contractor or junior operator is granted a role in the UniFi Network Application, and later an administrator revokes that access; because of the Incorrect Authorization flaw, under certain conditions the actor's prior privileges are not fully enforced, so from the network they continue to perform privileged controller actions such as modifying network/device configuration. No public POC is available, and the high attack complexity means the specific stale-state condition must be met, but the actor's existing low-privilege foothold is the key enabler.