CVE-2026-56841 is an authenticated SQL Injection vulnerability (CWE-89) in the UniFi Protect Application by Ubiquiti Inc. An attacker with network access and low privileges can exploit this vulnerability to escalate privileges on the host device. The vulnerability allows execution of unauthorized SQL commands due to improper input sanitization. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the affected versions are not specified.

Successful exploitation allows an attacker with low privileges and network access to escalate privileges on the host device running the UniFi Protect Application. This can lead to full compromise of the device, including unauthorized access to sensitive data, modification of system settings, and disruption of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the UniFi Protect Application to trusted users only and monitor for suspicious activity. Avoid exposing the application to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.