Loading vulnerability…
Authenticated SQL Injection in Ubiquiti UniFi Talk
CVE-2026-50747 is a critical authenticated SQL injection vulnerability affecting the Ubiquiti UniFi Talk Application. The issue consists of a series of SQL injection flaws caused by improper neutralization of structured query input in parameters passed to backend database queries. An attacker with network access and low-privileged authenticated access to UniFi Talk can exploit these flaws without user interaction to manipulate database operations and escalate privileges on the host device. Reported affected versions include UniFi Talk 5.1.2 and earlier, with the issue fixed in version 5.2.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow privilege escalation on the host device and broader control over the affected system. Given the reported CVSS characteristics and host-level privilege escalation outcome, the vulnerability can materially affect confidentiality, integrity, and availability of the device and its managed application environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting network access to UniFi Talk management interfaces to trusted administrative networks only, limiting low-privileged account creation and use, monitoring for anomalous authenticated activity against application endpoints, and reviewing database and application permissions to minimize post-exploitation privilege gain. Available information indicates vendor updates are the primary mitigation.
Patch, then assume compromise.
Upgrade UniFi Talk to version 5.2.2 or later. The underlying fix should ensure unsafe input is no longer incorporated into SQL queries, including use of parameterized queries or prepared statements, strict server-side input validation, and least-privilege database permissions for the application.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.