Loading vulnerability…
Privilege Escalation in UniFi Talk Application
CVE-2026-55119 is an improper access control vulnerability in the UniFi Talk Application. A malicious actor with network access and only low privileges can remotely exploit the flaw to escalate privileges within the application. The available information indicates that the issue stems from insufficient enforcement of authorization boundaries inside UniFi Talk, allowing an authenticated but low-privileged user to perform actions or access functionality intended for higher-privileged roles. Publicly available details do not identify the specific vulnerable function or endpoint.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows privilege escalation within the UniFi Talk Application. Because the vulnerability is rated with high confidentiality, integrity, and availability impacts, an attacker who gains elevated privileges may be able to access restricted application data, modify configuration or operational state, and disrupt normal service within the application context.
If you can’t patch tonight, do this now.
No interim workaround is reported as available. Until patching is completed, reduce exposure by limiting network access to UniFi Talk management and application interfaces to trusted administrative networks and users only, minimizing the number of low-privileged accounts, and reviewing role assignments and access control policies for unnecessary privileges.
Patch, then assume compromise.
Apply the vendor-provided fixed release for UniFi Talk. Available advisory information indicates patched versions are UniFi Talk 5.2.2 and later. Organizations should update affected deployments to the latest supported release and verify that authorization controls are correctly enforced after upgrade.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.