Cross-Site Request Forgery in UniFi OS

Publication date: 2026-07-02

Last updated on: 2026-07-09

Assigner: HackerOne

Description

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-02

Last Modified

2026-07-09

Generated

2026-07-22

AI Q&A

2026-07-02

EPSS Evaluated

2026-07-21

NVD

CVE-2026-55110

EUVD

EUVD-2026-41388

Affected Vendors & Products

Vendor	Product	Version / Range
ui	unifi_os_server	to 5.1.15 (inc)
ui	unifi_dream_machine_beast_firmware	to 5.1.15 (inc)
ui	unifi_dream_machine_pro_firmware	to 5.1.15 (inc)
ui	unifi_dream_machine_special_edition_firmware	to 5.1.15 (inc)
ui	unifi_dream_machine_pro_max_firmware	to 5.1.15 (inc)
ui	enterprise_fortress_gateway_firmware	to 5.1.15 (inc)
ui	unifi_dream_router_firmware	to 5.1.15 (inc)
ui	unifi_dream_wall_firmware	to 5.1.15 (inc)
ui	unifi_dream_router_7_firmware	to 5.1.15 (inc)
ui	unifi_express_7_firmware	to 5.1.15 (inc)
ui	unifi_cloudkey_firmware	to 5.1.15 (inc)
ui	unifi_cloud_key_plus_firmware	to 5.1.15 (inc)
ui	unifi_cloudkey_enterprise_firmware	to 5.1.15 (inc)
ui	unifi_network_video_recorder_firmware	to 5.1.15 (inc)
ui	unifi_network_video_recorder_pro_firmware	to 5.1.15 (inc)
ui	unifi_network_video_recorder_instant_firmware	to 5.1.15 (inc)
ui	enterprise_network_video_recorder_firmware	to 5.1.15 (inc)
ui	enterprise_network_video_recorder_core_firmware	to 5.1.15 (inc)
ui	unifi_network_video_recorder_g2_firmware	to 5.1.15 (inc)
ui	unifi_network_video_recorder_g2_pro_firmware	to 5.1.15 (inc)
ui	unifi_cloud_gateway_ultra_firmware	to 5.1.15 (inc)
ui	unifi_cloud_gateway_max_firmware	to 5.1.15 (inc)
ui	unifi_cloud_gateway_industrial_firmware	to 5.1.15 (inc)
ui	unifi_cloud_gateway_fiber_firmware	to 5.1.15 (inc)
ui	unas_2_firmware	to 5.1.16 (inc)
ui	unas_4_firmware	to 5.1.16 (inc)
ui	unas_pro_firmware	to 5.1.16 (inc)
ui	unas_pro_4_firmware	to 5.1.16 (inc)
ui	unas_pro_8_firmware	to 5.1.16 (inc)
ui	enterprise_firewall_core_firmware	to 5.1.18 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Origin Resource Sharing (CORS) misconfiguration in UniFi OS. It allows a malicious actor to exploit the system by tricking an authenticated user into visiting a malicious webpage. When the user visits this page, the attacker can use the user's session to trigger actions within UniFi OS without their consent.

Impact Analysis

The vulnerability can lead to unauthorized actions being performed in UniFi OS using the session of an authenticated user. This can result in a high impact on confidentiality, integrity, and availability of the system, as indicated by the CVSS score. An attacker could potentially manipulate or disrupt the system by leveraging the victim's session.

Hi! I’m here to help you understand CVE-2026-55110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70