pfSense-pkg-RESTAPI: Privilege escalation via Scoped HA Settings Sync (CVE-2026-113779)

The pfSense REST API package (pfSense-pkg-RESTAPI) is vulnerable to a privilege escalation flaw (CVE-2026-113779) in versions prior to 2.9.0. Authenticated users assigned the 'Scoped HA Settings Sync' privilege can interact with the HA settings sync endpoint to modify REST API configuration secrets. This lack of proper access control allows a non-administrative user to elevate their privileges to full administrator. Version 2.9.0 mitigates this by restricting the HA settings sync endpoint to full administrative privileges ('page-all') and removing the sub-administrative sync privilege entirely.

Impact

Successful exploitation allows a low-privileged authenticated user to elevate their access to full administrator, granting them complete control over the pfSense REST API and the underlying firewall configuration.

Recommendation

• Upgrade pfSense-pkg-RESTAPI to version 2.9.0 or later immediately.
• If patching is not immediately possible, revoke the 'api-v2-system-restapi-settings-sync-post' privilege from all non-administrative users.
• Restrict access to REST API endpoints to trusted administrator and HA peer IP addresses using REST API Access Control Lists (ACLs) and firewall rules.