# UniFi Video web interface Configuration Restore user privilege escalation

Low-privileged UniFi Video users could POST to the backup/wizard config-restore endpoints, overwrite application configuration, and create administrative users.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: ajxchapman
- Disclosed: 2020-04-01
- CVE: CVE-2020-8145
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/329659
- Library page: https://bugbountylibrary.com/r/h1%3A329659
- Tags: area:web domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high technique:source-review vuln:access-control vuln:privilege-escalation

**Target:** UniFi Video Server (Windows) web interface backup/wizard endpoints
**Root cause:** The configuration restore functionality at the backup and wizard endpoints lacks sufficient privilege checks, letting users in PUBLIC_GROUP or CUSTOM_GROUP overwrite the full application configuration.
**Steps:**
1. Authenticate to the UniFi Video web interface as a low-privileged user (PUBLIC_GROUP or CUSTOM_GROUP).
2. Access the configuration restore functionality at the `backup` and `wizard` endpoints.
3. Submit a configuration that overwrites application settings, e.g. adding a new administrative user.
4. Log in as the newly created admin to confirm escalation.
**Exploitation:** A low-privileged authenticated user reaches the config-restore endpoints and overwrites the application configuration, including creating new administrative accounts, gaining full admin control.
**Escalation:** Adding a new administrative user via the restored configuration escalates from low-privileged group membership to full admin.
**Insight:** Config restore/import endpoints are a common privilege-check gap: they write the whole settings object, so test them with the lowest-privilege account and try injecting admin user records into the restored config.