Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113779— pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission

Quick assessment

Affected
pfrest pfSense-pkg-RESTAPI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pfSense REST API 是一个非官方的开源 REST 和 GraphQL API，适用于 pfSense CE 和 pfSense Plus 防火墙。在 pfSense-pkg-RESTAPI 2.9.0 之前的版本中存在一个权限提升漏洞：拥有专用“设置同步”权限的已认证用户可修改 REST API 的配置密钥，从而使非管理员用户能够将其权限提升至完全管理员。pfSense-pkg-RESTAPI 2.9.0 已修复此问题。现在，访问高可用性（HA）设置同步端点严格需要完全管理员权限（ ），而子管理员级别

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113779

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission
Source: CVE Program / CVE List V5
Vulnerability Description
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pfrest pfSense-pkg-RESTAPI < 2.9.0 -

II. Public POCs for CVE-2026-113779

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113779

请登录查看更多情报信息。

Other References for CVE-2026-113779 (2)

IV. Related Vulnerabilities

Same weakness: CWE-502

V. Comments for CVE-2026-113779

No comments yet

Leave a comment