CVE-2026-22558
Received Received - Intake

Authenticated NoSQL Injection in UniFi Network App Enables Privilege Escalation

Publication date: 2026-03-19

Last updated on: 2026-03-19

Assigner: HackerOne

Description
An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-19
Last Modified
2026-03-19
Generated
2026-07-26
AI Q&A
2026-03-19
EPSS Evaluated
2026-07-25
NVD
CVE-2026-22558
EUVD
EUVD-2026-13104

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authenticated NoSQL Injection found in the UniFi Network Application. It allows a malicious actor who already has authenticated access to the network to exploit the NoSQL database queries in order to escalate their privileges.

Detection Guidance

I don't know

Impact Analysis

The impact of this vulnerability is that an attacker with authenticated access could escalate their privileges within the network. This means they could gain higher-level permissions than intended, potentially leading to unauthorized access to sensitive data or control over network resources.

Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22558. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart