high7.5
CVE-2026-55110
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS t…
Impact
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ui | Unifi Os Server | through 5.1.15 |
| Ui | Unifi Dream Machine Beast Firmware | through 5.1.15 |
| Ui | Unifi Dream Machine Pro Firmware | through 5.1.15 |
| Ui | Unifi Dream Machine Special Edition Firmware | through 5.1.15 |
| Ui | Unifi Dream Machine Pro Max Firmware | through 5.1.15 |
| Ui | Enterprise Fortress Gateway Firmware | through 5.1.15 |
| Ui | Unifi Dream Router Firmware | through 5.1.15 |
| Ui | Unifi Dream Wall Firmware | through 5.1.15 |
| Ui | Unifi Dream Router 7 Firmware | through 5.1.15 |
| Ui | Unifi Express 7 Firmware | through 5.1.15 |
| Ui | Unifi Cloudkey Firmware | through 5.1.15 |
| Ui | Unifi Cloud Key Plus Firmware | through 5.1.15 |