CVE-2026-77538: CWE-284 Improper Access Control - Generic in Ubiquiti Inc UniFi Connect Application

This vulnerability (CVE-2026-77538) involves improper access control (CWE-284) in the UniFi Connect Application by Ubiquiti Inc. An attacker with network access could exploit this flaw to escalate privileges within the application, potentially gaining unauthorized control or capabilities. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. No patch or official remediation level has been disclosed by the vendor as of the publication date.

An attacker on the network can escalate privileges within the UniFi Connect Application, potentially leading to unauthorized modification of application data or settings (high integrity impact). There is no direct confidentiality impact, and availability impact is low. This could compromise the security posture of the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is currently provided by Ubiquiti, monitor the vendor's channels for updates. Until a patch is available, restrict network access to the UniFi Connect Application to trusted users only to reduce exposure.