Executive brief
Ubiquiti UniFi Talk is a business communication application used for managing VoIP phone systems. A security vulnerability has been identified where an authorized user with low-level access can bypass security controls to gain higher-level administrative privileges. This could allow an internal user to access sensitive communication data or modify system settings without authorization.
Technical details
An improper access control vulnerability (CWE-284) exists in the Ubiquiti UniFi Talk Application prior to version 5.2.2. A malicious actor with network access and existing low-level credentials can exploit this flaw to escalate their privileges to a higher level within the application. The attack vector is network-based and requires low privileges but no user interaction. The vulnerability has been addressed in UniFi Talk Application version 5.2.2.
Affected products
- Ubiquiti Inc UniFi Talk Application < 5.2.2
Timeline
- 2026-07-02: advisory
- 2026-07-02: disclosed