CVE-2026-56841: UniFi Protect SQL Injection Privilege Escalation (CVSS 8.8)

Technical summary

CVE-2026-56841 is an authenticated SQL injection (CWE-89) affecting UniFi Protect. The vulnerability exists in the application logic that processes user-supplied input without proper parameterization or input validation. An authenticated attacker with low privileges (PR:L) can craft malicious SQL statements that, when processed by the database, allow privilege escalation on the host device. The attack requires network access (AV:N) and no user interaction (UI:N), making it exploitable by any low-privilege account on the network. The CVSS v3.1 score of 8.8 (HIGH) reflects high impact across confidentiality, integrity, and availability.

Business impact

A successful exploit enables an attacker to move laterally through a UniFi Protect deployment by escalating to administrative or system-level privileges. Once elevated, an attacker can modify security camera settings, access recorded footage without audit trails, disable monitoring capabilities, or pivot to other networked devices. For organizations relying on UniFi Protect for physical security or compliance-mandated surveillance, this vulnerability could lead to loss of security visibility, regulatory non-compliance, and potential incident investigation blindness.

Affected systems

UniFi Protect application instances are affected. The vulnerability applies to deployments where network users have authentication credentials and access to the application interface. This includes on-premises UniFi Protect installations and cloud-hosted deployments where users are provisioned with accounts.

Exploitability

The attack is relatively straightforward once authenticated. No special exploit code or zero-day techniques are required—standard SQL injection payloads can be adapted to the application's query structure. The barrier to exploitation is authentication; an attacker must possess or obtain valid credentials. However, in environments with weak password policies or where accounts are shared, this barrier is minimal. The attack requires no user interaction and can be automated.

Remediation

Apply the security patch released by Ubiquiti for UniFi Protect as soon as feasible. Verify the patch version against Ubiquiti's official advisory. In parallel, implement network segmentation to restrict access to UniFi Protect to trusted administrative users and networks. Review and enforce strong password policies for all UniFi Protect accounts. Audit account permissions and remove unnecessary low-privilege access. Monitor database activity and application logs for anomalous SQL queries or privilege escalation attempts.

Patch guidance

Check Ubiquiti's security advisory for the specific patched version number for your UniFi Protect installation. Update through the standard UniFi Protect update mechanism. Verify the patch has been applied by confirming the version in the application settings matches the recommended patch version. Test in a staging environment before deploying to production to ensure no configuration drift or third-party integration breakage.

Detection guidance

Monitor UniFi Protect application logs for failed and successful authentication attempts from unexpected sources. Search database logs for unusual SQL syntax in query patterns, including SELECT, UNION, or comment sequences (-- or /**/). Track privilege escalation events in system and application audit logs. Network monitoring can flag unusual traffic patterns to the UniFi Protect database port. Implement alerting on database error messages that suggest injection attempts (SQL syntax errors in application contexts).

Why prioritize this

Although CVE-2026-56841 requires authentication, the ease of exploitation and high impact justify rapid patching. Privilege escalation to system level is a critical outcome in security camera and physical access control systems. The broad impact vector (confidentiality, integrity, availability all HIGH) means a successful exploit can compromise the entire security posture of a facility or network segment. Organizations should prioritize this above non-authenticated vulnerabilities of equivalent CVSS score if UniFi Protect is central to their security infrastructure.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network-accessible attack surface, (2) no special conditions required once authenticated (low complexity), (3) low-privilege attacker profile (does not require admin), (4) unrestricted scope within the host device, and (5) complete compromise of confidentiality, integrity, and availability. The primary limiting factor is the requirement for prior authentication, which prevents a score in the CRITICAL range but does not materially reduce real-world risk in many enterprise environments where account compromise is common.

Frequently asked questions