CVE-2026-50747: A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device

Synopsis

Authenticated SQL injection vulnerabilities in the UniFi Talk Application allow a network-accessible attacker with low-privilege credentials to escalate privileges on the host device. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates the service is reachable over the network, no victim interaction is needed, and the scope change means impact extends beyond the application itself. Successful exploitation gives the attacker full read, write, and availability impact on both the application and the underlying host. A patched-image rebuild at version 5.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UniFi Talk Application service over the network; there is no requirement for local or physical access.

• AuthenticationRequired

  A low-privilege account on the application is sufficient to trigger the SQL injection payloads; no admin credentials are needed.

• Victim interactionNot required

  The attacker does not need any user or administrator to take an action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout knowledge.

Blast Radius

• The attacker reads arbitrary data from the application database, including stored credentials, session tokens, and configuration records.
• The attacker modifies or deletes persisted database rows, corrupting application state or creating new privileged accounts.
• Because the CVSS scope is changed, the attacker can escalate privileges beyond the application and execute commands on the underlying host device.
• Full availability impact means the attacker can crash or render the UniFi Talk Application and host services unresponsive.