This vulnerability (CVE-2026-55110) in UniFi OS Server is due to a permissive CORS policy that includes untrusted domains, classified under CWE-942. It enables a malicious actor to exploit the CORS misconfiguration by luring an authenticated user to a malicious webpage, thereby leveraging the user's session to perform unauthorized actions on the UniFi OS. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to perform actions on the UniFi OS Server with the privileges of an authenticated user, potentially leading to full compromise of confidentiality, integrity, and availability of the system. This can result in unauthorized access, data manipulation, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted web content while authenticated to UniFi OS and consider limiting exposure of the affected service. Monitor vendor communications for updates on patches or mitigations.