Improper Access Control in Ubiquiti UniFi Connect

An unauthenticated, network-adjacent attacker can escalate privileges within the UniFi Connect Application. Reported to Ubiquiti through its bug bounty program and fixed in version 3.24.22.

Summary

UniFi Connect is Ubiquiti's application for managing its Connect line of devices. CVE-2026-77538 is an improper access control vulnerability (CWE-284) in that application: an operation that should be gated behind proper authorization is reachable by an attacker with network access, letting them escalate privileges within the application.

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the UniFi Connect Application. — CVE-2026-77538, official record (NVD / MITRE)

Impact

The CVSS 3.1 vector tells the story of why this rates High:

• Network attack vector (AV:N) — reachable over the network, not limited to physical or local access.
• No privileges required (PR:N) and no user interaction (UI:N) — the attacker does not need to authenticate or trick a user.
• Low attack complexity (AC:L) — no special conditions or timing are needed.
• High integrity impact (I:H) — the attacker gains the ability to perform privileged actions inside UniFi Connect, with a low availability impact (A:L).

Ubiquiti further notes that the issue can be chained with vulnerable dependencies to escalate privileges on the host device. In other words, what starts as a privilege escalation confined to the application can, in combination with other weaknesses, extend to the underlying system, widening the blast radius well beyond UniFi Connect itself.

Affected and fixed versions

• Affected: UniFi Connect Application before 3.24.22.
• Fixed: UniFi Connect Application 3.24.22 and later.

Operators should update to 3.24.22 or newer and restrict network exposure of the management application to trusted segments.

Root cause

At its core this is an authorization gap. A privileged code path in UniFi Connect did not correctly verify that the caller was allowed to reach it, so a network-adjacent actor with no credentials could invoke functionality that should have been restricted. Because authentication and user interaction are both out of the picture and complexity is low, the barrier to exploitation is minimal for anyone able to reach the application on the network.

Disclosure timeline

• 2026
  Reported to Ubiquiti through its HackerOne bug bounty program under coordinated disclosure.
• 2026-08-26
  Fixed in UniFi Connect 3.24.22 and published in Ubiquiti Security Advisory Bulletin 067; CVE-2026-77538 assigned.

Credit

Discovered and reported by Andrii Timofeev under Ubiquiti's bug bounty program on HackerOne. Thanks to the Ubiquiti security team for triaging and remediating the issue.

References

• Ubiquiti Security Advisory Bulletin 067
• NVD — CVE-2026-77538
• MITRE CVE.org — CVE-2026-77538
• Ubiquiti bug bounty program (HackerOne)