Description

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-26T10:16:41.173Z",
  "pubdate": "2026-08-26T10:16:41.173Z",
  "executiveSummary": "This vulnerability involves an Improper Access Control flaw within UniFi OS, which allows authenticated users with low privileges to escalate their authorization level within the system.\nThe vulnerability is characterized by a failure in the application's permission enforcement mechanisms, permitting unauthorized access to administrative or high-privilege functions that should be restricted to elevated user roles.\nAffected systems include various devices running UniFi OS. Successful exploitation leads to privilege escalation, potentially granting the attacker full control over the affected UniFi OS instance.\nExploitation requires the attacker to have established network access and a valid, low-privileged user account on the target system.\nThe risk implication is critical, as it bypasses the security boundary between standard users and system administrators, facilitating unauthorized configuration changes, data exfiltration, or complete device compromise.\nThis vulnerability reflects a failure in secure authorization logic, emphasizing the need for rigorous access control validation at the API and application interface levels.",
  "technicalDetails": "The root cause of this vulnerability lies in an Improper Access Control implementation, specifically involving a lack of rigorous authorization checks when processing requests directed at sensitive UniFi OS management functions.\nUnder normal operating conditions, UniFi OS should enforce Role-Based Access Control (RBAC) to restrict administrative operations to authenticated entities with sufficient privileges.\nThe vulnerability manifests when the application backend fails to adequately validate the user's privilege level against the requested action or resource identifier during the handling of specific network requests.\nThe attack flow commences with the attacker establishing network connectivity to the vulnerable UniFi OS device. The attacker utilizes a valid, low-privileged account to interact with the web management interface or the underlying API endpoints.\nBy manipulating requests—such as altering request parameters, modifying API call structures, or replaying administrative requests—the attacker circumvents the intended authorization barriers. The system, failing to verify that the requesting user possess the necessary permissions for the targeted endpoint, processes the request as if it originated from a privileged user.\nPost-exploitation, the attacker gains the ability to execute unauthorized administrative actions. This may include, but is not limited to, modifying device configurations, altering network routing policies, creating new administrative accounts, or accessing sensitive diagnostic and system data that were previously protected by access control lists.\nThe impact is significant due to the centralization of UniFi OS management. Because these devices often serve as critical infrastructure within a network, escalating privileges allows an attacker to pivot, perform lateral movement, or conduct further malicious activities from a position of absolute trust within the management interface.\nThe vulnerability is limited to the local instance of UniFi OS; however, once full administrative control is achieved, the attacker can leverage the device's management capabilities to further compromise the connected environment."
}