Skip to content
OpenAdvisories
High · 7.5 CVE-2026-55110 EUVD-2026-41388GHSA-fwmw-87x4-wjv5

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration…

Published Jul 2, 2026 · Updated Jul 2, 2026 · Assigned by hackerone

Vendor: Ubiquiti Product: Cloud Gateways Product: Cloud Keys Product: Dream Machines Product: Dream Routers Product: Dream Wall Product: Enterprise Firewall Core Product: Enterprise Fortress Gateway Product: Enterprise Video Recorders Product: Express 7 Product: Network Attached Storage Product: Network Video Recorders Product: UniFi OS Server Category: Network devices

Description

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.

Affected products

VendorProductAffectedFixed
Ubiquiti UniFi OS Server < 5.1.19 5.1.19
Ubiquiti Dream Machines < 5.1.19 5.1.19
Ubiquiti Enterprise Fortress Gateway < 5.1.19 5.1.19
Ubiquiti Dream Wall < 5.1.19 5.1.19
Ubiquiti Dream Routers < 5.1.19 5.1.19
Ubiquiti Express 7 < 5.1.19 5.1.19
Ubiquiti Cloud Keys < 5.1.19 5.1.19
Ubiquiti Network Video Recorders < 5.1.19 5.1.19
Ubiquiti Enterprise Video Recorders < 5.1.19 5.1.19
Ubiquiti Cloud Gateways < 5.1.19 5.1.19
Ubiquiti Network Attached Storage < 5.1.19 5.1.19
Ubiquiti Enterprise Firewall Core < 5.1.19 5.1.19

Advisories 2

References