CVE-2025-52665 Missing authorization in UniFi Access Application

Critical 10.0 Published 30 Oct 2025 Updated 31 Oct 2025

Attackers on the management network can access the UniFi Access management API without authentication due to a misconfiguration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-52665?

CVE-2025-52665 is a critical missing authorization vulnerability in Ubiquiti Inc UniFi Access Application, published on 30 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. Affected Products: UniFi Access Application (Version 3.3.22 through 3.4.31).  

Mitigation: Update your UniFi Access Application to Version 4.0.21 or later.

Weakness: CWE-306

Which versions are affected by CVE-2025-52665?

It affects 1 product.

Products include Ui Unifi Access.

How do I fix CVE-2025-52665?

No fix has been published for CVE-2025-52665 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-52665 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-52665 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-2rj5-gh6q-72fp.