Loading vulnerability…
Incorrect Authorization in UniFi Network Application
An incorrect authorization vulnerability in UniFi Network Application allows a malicious actor with network access, under certain conditions, to retain or persist privileges within the application after that access should have been removed. The flaw affects UniFi Network Application version 10.3.58 and earlier and is addressed in version 10.4.57 and later. The issue stems from improper enforcement of authorization state, enabling privilege persistence beyond intended revocation boundaries.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker to continue operating with previously granted privileges inside UniFi Network Application even after those privileges or the underlying access should have been revoked. This can undermine administrative control and authorization boundaries, potentially enabling continued access to protected functionality, unauthorized configuration changes, and prolonged unauthorized presence within the application.
If you can’t patch tonight, do this now.
No interim workaround information is currently available. The primary mitigation is prompt installation of the vendor-provided fixed release. Until updates can be applied, reduce exposure by limiting network access to the application to trusted administrative networks and tightly controlling which users and systems can reach the management interface.
Patch, then assume compromise.
Upgrade UniFi Network Application to version 10.4.57 or later, which contains the vendor fix for this vulnerability. Because the issue involves privilege persistence after access removal, administrators should also review existing accounts, sessions, roles, and authorization state after patching to ensure no improperly retained privileges remain.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.