CVE-2026-54407 describes an improper access control vulnerability (CWE-284) in the UniFi Protect Application by Ubiquiti Inc. An attacker with access to the network can exploit this flaw to bypass authentication on certain API endpoints of the application. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Exploitation of this vulnerability could allow an unauthenticated attacker on the network to bypass authentication controls on specific API endpoints of the UniFi Protect Application. This may result in limited confidentiality and integrity compromise, as well as a high impact on availability of the affected service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the UniFi Protect Application APIs to trusted users only and monitor for unusual activity. Follow vendor communications closely for updates on patches or mitigations.