Description

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-26T10:16:41.417Z",
  "pubdate": "2026-08-26T10:16:41.417Z",
  "executiveSummary": "This vulnerability involves an improper access control flaw within UniFi OS, which may allow an authenticated user with low privileges to escalate their current access levels.\nThe vulnerability is characterized by a failure in the application's permission management, where the system incorrectly validates user authorization for specific sensitive functions or data objects.\nAn attacker with existing network access and low-level credentials can leverage this flaw to perform unauthorized actions, potentially gaining administrative or elevated privileges within the context of the UniFi OS instance.\nThe risk implication is significant as it facilitates unauthorized control over the device or service management, potentially leading to a total compromise of the UniFi OS environment.\nExploitation requires the attacker to have at least low-level authenticated access to the network or the device interface.\nThe impact includes unauthorized privilege escalation, which can lead to complete administrative takeover of the affected UniFi OS device, facilitating further malicious activity within the network environment.",
  "technicalDetails": "The vulnerability resides in the access control mechanism governing the inter-process communication or API request handling within UniFi OS. The root cause is a failure to consistently enforce authorization checks on sensitive administrative functions when requested by users with restricted privilege levels.\nWhen a user authenticated with low privileges interacts with the UniFi OS web interface or API, the backend components responsible for processing these requests fail to verify if the user possesses the required authorization level for the target action or resource. Instead of rejecting the request, the underlying service assumes that the initial authentication check is sufficient, inadvertently granting access to administrative operations that should be restricted.\nThe attack flow proceeds as follows: First, the attacker establishes a session with the UniFi OS device using low-privileged, legitimate credentials. Second, the attacker performs service enumeration to identify reachable administrative endpoints or API calls that interact with sensitive configuration data or system settings. Third, the attacker crafts a malicious request targeting these specific endpoints. Because the improper access control flaw exists within the input validation and session management layers of the UniFi OS application logic, the device fails to gatekeep access to these functions.\nBy manipulating the parameters within these requests, an attacker can bypass standard security controls, effectively executing commands or accessing data reserved for administrative users. This effectively transitions the attacker from a low-privilege user to an elevated status, granting them the ability to modify system configurations, alter security settings, or perform arbitrary administrative tasks on the affected UniFi OS instance.\nThe vulnerability does not necessarily require the exploitation of memory corruption or code execution vulnerabilities, but rather leverages the logical flaw in the application's security policy enforcement. Post-exploitation, the attacker maintains persistent unauthorized access to administrative functions, enabling the potential for further lateral movement within the network or the deployment of additional malicious payloads or backdoors on the device."
}