Loading vulnerability…
Authenticated SQL Injection in UniFi Protect Application
CVE-2026-56841 is an authenticated SQL injection vulnerability in the UniFi Protect Application affecting version 7.1.77 and earlier. The flaw can be exploited by an attacker with network access and low-privileged authenticated access to the application. By supplying crafted input to vulnerable database-backed functionality, the attacker can manipulate SQL queries and leverage the condition to escalate privileges on the host device. The vulnerability is remotely exploitable, requires no user interaction, and has been assessed as high severity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged attacker to escalate privileges on the host device hosting or running the UniFi Protect Application. The reported impact includes compromise of confidentiality, integrity, and availability at a high level, consistent with the attacker gaining elevated control beyond the originally assigned application privileges.
If you can’t patch tonight, do this now.
No interim vendor workaround is available. The primary mitigation is prompt application of the vendor patch. Until updates can be applied, reduce exposure by limiting network access to the application to trusted administrative networks and minimizing the number of low-privileged accounts that can authenticate to the affected service.
Patch, then assume compromise.
Upgrade UniFi Protect Application to version 7.1.83 or later. As a secure coding remediation, database interactions associated with the vulnerable functionality should use parameterized queries or prepared statements, and all user-supplied input should be strictly validated and sanitized. Access-control enforcement around the affected functionality should also be reviewed to ensure low-privileged users cannot reach sensitive operations in a way that enables privilege escalation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.