Cpe:2.3:a:pfsense:pfrest:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apfsensepfrest/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 16:06:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgpfSense-pkg-RESTAPI: Privilege escalation via Scoped HA Settings Sync (CVE-2026-113779)https://feed.craftedsignal.io/briefs/2026-10-pfsense-rest-api-priv-esc/Wed, 21 Oct 2026 16:06:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-pfsense-rest-api-priv-esc/Authenticated users with the 'Scoped HA Settings Sync' permission can exploit CVE-2026-113779 in pfSense-pkg-RESTAPI versions prior to 2.9.0 to modify API configuration secrets and achieve full administrative privilege escalation.The pfSense REST API package (pfSense-pkg-RESTAPI) is vulnerable to a privilege escalation flaw (CVE-2026-113779) in versions prior to 2.9.0. Authenticated users assigned the 'Scoped HA Settings Sync' privilege can interact with the HA settings sync endpoint to modify REST API configuration secrets. This lack of proper access control allows a non-administrative user to elevate their privileges to full administrator. Version 2.9.0 mitigates this by restricting the HA settings sync endpoint to full administrative privileges ('page-all') and removing the sub-administrative sync privilege entirely.

Impact

Successful exploitation allows a low-privileged authenticated user to elevate their access to full administrator, granting them complete control over the pfSense REST API and the underlying firewall configuration.

Recommendation

  • Upgrade pfSense-pkg-RESTAPI to version 2.9.0 or later immediately.
  • If patching is not immediately possible, revoke the 'api-v2-system-restapi-settings-sync-post' privilege from all non-administrative users.
  • Restrict access to REST API endpoints to trusted administrator and HA peer IP addresses using REST API Access Control Lists (ACLs) and firewall rules.
]]>highadvisoryprivilege-escalationpfsenseapi-security