The vulnerability is an Improper Access Control flaw (CWE-284) in Ubiquiti Inc's UniFi Access Application. It allows an attacker who already has network connectivity and high local privileges to bypass the application's authorization checks and elevate their privileges on the host device. The description indicates that privilege escalation on the host device is possible; no further impact such as full system compromise or network takeover is detailed.

The affected product is Ubiquiti Inc's UniFi Access Application. The advisory does not provide specific version information, so any installation running before the release of the corrective update should be inspected against Ubiquiti's security bulletin to confirm whether the patch has been applied.

The CVSS score of 9.1 indicates, integrity, and availability. The EPSS score is under 1%, suggesting that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require network access and high local privileges on the host device; the attacker must already have access to the network and privileged rights. Under these conditions, the flaw permits privilege escalation on the host.