The CVE describes an Improper Access Control flaw in Ubiquiti Inc's UniFi Talk Application that allows an attacker who has network access and holds a low‑privilege account to raise their privileges inside the application. The weakness is classified as CWE-284, indicating the failure to enforce correct authorization checks. The consequence of success is that the attacker gains broader control within UniFi Talk, potentially affecting the confidentiality, integrity, or availability of the application’s data and functions.

This vulnerability applies to Ubiquiti Inc's UniFi Talk Application. No specific version numbers are listed in the advisory; therefore, any installation that has not confirmed the application has been updated to remove the flaw should be considered vulnerable.

The CVSS score of 8.1 class high severity, yet the EPSS score of < 1% indicates a very low probability of exploitation at the time of analysis. The vulnerability is not included in the CISA KEV catalog. Attackers would need to be on the same local network and possess legitimate but low‑privilege credentials to make environments lacking network segmentation or with overly permissive user permissions particularly at risk.