CVE-2026-55110

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.

• ui unifi os server (<= 5.1.15) • ui unifi dream machine beast firmware (<= 5.1.15) • ui unifi dream machine pro firmware (<= 5.1.15) • ui unifi dream machine special edition firmware (<= 5.1.15) • ui unifi dream machine pro max firmware (<= 5.1.15) • ui enterprise fortress gateway firmware (<= 5.1.15) • ui unifi dream router firmware (<= 5.1.15) • ui unifi dream wall firmware (<= 5.1.15) • ui unifi dream router 7 firmware (<= 5.1.15) • ui unifi express 7 firmware (<= 5.1.15) • ui unifi cloudkey firmware (<= 5.1.15) • ui unifi cloud key plus firmware (<= 5.1.15) • ui unifi cloudkey enterprise firmware (<= 5.1.15) • ui unifi network video recorder firmware (<= 5.1.15) • ui unifi network video recorder pro firmware (<= 5.1.15) • ui unifi network video recorder instant firmware (<= 5.1.15) • ui enterprise network video recorder firmware (<= 5.1.15) • ui enterprise network video recorder core firmware (<= 5.1.15) • ui unifi network video recorder g2 firmware (<= 5.1.15) • ui unifi network video recorder g2 pro firmware (<= 5.1.15) • ui unifi cloud gateway ultra firmware (<= 5.1.15) • ui unifi cloud gateway max firmware (<= 5.1.15) • ui unifi cloud gateway industrial firmware (<= 5.1.15) • ui unifi cloud gateway fiber firmware (<= 5.1.15) • ui unas 2 firmware (<= 5.1.16) • ui unas 4 firmware (<= 5.1.16) • ui unas pro firmware (<= 5.1.16) • ui unas pro 4 firmware (<= 5.1.16) • ui unas pro 8 firmware (<= 5.1.16) • ui enterprise firewall core firmware (<= 5.1.18)