UI:R means exploitation needs some action from a person other than the attacker, such as opening a file or following a link. It lowers the CVSS score slightly, but it does not make a finding safe. Whether it helps you depends on who your users are and how likely that action is.
The two values
CVSS 3.1 defines User Interaction as whether a user other than the attacker must take part in the attack.
| Value | Vector text | Meaning |
|---|---|---|
| None | UI:N | Exploitation needs no action from any user |
| Required | UI:R | A user must take some action before exploitation succeeds |
The specification gives an example of the second kind: the action occurs during an administrator's installation of an application. Note that this metric is kept separate from Attack Complexity. A needed click is scored under UI, not under AC.
The numeric constants are 0.85 for None and 0.62 for Required. The gap is real but modest. A vector with UI:R still often lands in the high or critical band when the impact metrics are all High.
Why people over-trust UI:R
It is tempting to think no one clicks. In practice, the action required is often something users do all day: open a document, view a web page, run an installer. The metric records that an action is needed. It does not record how ordinary the action is.
Two flaws with identical vectors except for UI illustrate the point. One requires a user to open a crafted image. Another requires an administrator to run a specific command in a rare maintenance window. Both are UI:R. Their real exposure is far apart.
How to weigh it
- Name the action. The advisory text will say what the user must do. If you cannot find it, treat the metric as unclear.
- Ask who the user is in your system. An employee, a customer, an automated job or a machine process.
- Ask whether the action happens routinely. Opening an attachment or loading a page is routine. Running a rare admin task is not.
- If the "user" is an automated process, UI:R may offer no protection at all, since software performs the action on every run.
- Combine with Attack Vector and Privileges Required. UI:R with AV:N and PR:N is a very different situation from UI:R with AV:L and PR:H.
Code and libraries need a different lens
Many findings in dependency scans concern libraries that process input such as images, archives or markup. The "user action" may be nothing more than your service accepting an upload and passing it to the library. In that case your own upload feature is the interaction, and the person who performs it is your customer. Read the advisory to see which input reaches the flawed code, then look at where that input enters your product.
What to record
Write the action and the actor next to the finding. For example: "requires a signed-in customer to upload a file; upload handler passes it to the library". It shows you checked, and it tells the next reader what would change the decision, such as turning off uploads.
Safeguard's dependency scanning and reachability analysis help you see where a vulnerable library sits in your code and whether your code calls it, which is the first step to knowing what the "interaction" would be. A free scan is at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Notice which signals change a finding's priority and which do not.
Quick check
Does UI:R mean the attack needs the victim to be careless?
Not necessarily. The required action can be ordinary, like opening a file or loading a page, and the metric does not measure how likely it is.
Is a click scored under Attack Complexity?
No. The specification keeps user action in the User Interaction metric and excludes it from Attack Complexity.
Sources
Last reviewed: 19 October 2026.
