Description

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T11:16:39.520Z",
  "pubdate": "2026-08-26T11:16:39.520Z",
  "executiveSummary": "A critical Improper Access Control vulnerability exists within the UniFi Protect AI Key, enabling authenticated network attackers to escalate privileges on the affected hardware.\nThe vulnerability stems from flawed access control enforcement, which allows unauthorized manipulation of system-level permissions.\nSuccessful exploitation grants an attacker elevated administrative rights, potentially compromising the integrity, confidentiality, and availability of the device.\nThis vulnerability is particularly severe as it resides on the physical access control hardware, where gaining administrative control could facilitate further unauthorized physical facility access.\nExploitation requires the attacker to have established network access to the target device.\nOrganizations deploying UniFi Protect AI Key should prioritize restricting network access to the management interface and monitoring for anomalous privilege escalation attempts.",
  "technicalDetails": "The vulnerability is classified as an Improper Access Control flaw within the UniFi Protect AI Key authorization logic. At its core, the issue resides in the insufficient validation of user-supplied requests when interacting with internal API endpoints responsible for role-based access control (RBAC) and authorization management.\nThe root cause is identified as a failure to strictly enforce access policy checks on critical configuration functions. Specifically, the system fails to correctly verify the privilege level of the authenticated user when processing requests that modify system permission sets or account attributes. Because the access control mechanism is bypassable, an attacker with valid, low-privileged credentials—or potentially unauthenticated access depending on specific endpoint visibility—can submit malformed requests to manipulate their own authorization context.\nThe attack flow commences with the adversary establishing connectivity to the UniFi Protect AI Key management network. Once the initial network connection is established, the attacker probes the backend API for exposed interfaces. By identifying specific endpoints that govern user management or permission assignment, the attacker constructs a crafted HTTP request designed to promote their existing session privilege level.\nDue to the lack of server-side state verification, the device processes the unauthorized request and updates the internal access control list (ACL) or the associated session token in memory to reflect administrative privileges. This elevation of privilege allows the attacker to execute arbitrary administrative commands that would otherwise be restricted, including the ability to manage connected locks, view sensitive event logs, and alter global security parameters.\nPost-exploitation impact includes full administrative control over the AI Key device. Given the function of the UniFi Protect AI Key in security ecosystems, this level of access may allow an attacker to trigger physical ingress/egress points by manipulating lock state configurations, disabling security alerts, or deleting forensic evidence of unauthorized access. The vulnerability exposes the device to persistent configuration changes, allowing for potential backdoor installation or long-term credential harvesting from the device's management database.\nThe exploitation mechanism leverages the device's trust in client-side input for sensitive operations, circumventing the intended defensive boundary between user and administrator roles."
}