{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/pfsense/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pfsense:pfrest:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-113779"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pfSense-pkg-RESTAPI (\u003c 2.9.0)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","pfsense","api-security"],"_cs_type":"advisory","_cs_vendors":["pfSense"],"content_html":"\u003cp\u003eThe pfSense REST API package (pfSense-pkg-RESTAPI) is vulnerable to a privilege escalation flaw (CVE-2026-113779) in versions prior to 2.9.0. Authenticated users assigned the 'Scoped HA Settings Sync' privilege can interact with the HA settings sync endpoint to modify REST API configuration secrets. This lack of proper access control allows a non-administrative user to elevate their privileges to full administrator. Version 2.9.0 mitigates this by restricting the HA settings sync endpoint to full administrative privileges ('page-all') and removing the sub-administrative sync privilege entirely.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged authenticated user to elevate their access to full administrator, granting them complete control over the pfSense REST API and the underlying firewall configuration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade pfSense-pkg-RESTAPI to version 2.9.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately possible, revoke the 'api-v2-system-restapi-settings-sync-post' privilege from all non-administrative users.\u003c/li\u003e\n\u003cli\u003eRestrict access to REST API endpoints to trusted administrator and HA peer IP addresses using REST API Access Control Lists (ACLs) and firewall rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T16:06:05Z","date_published":"2026-10-21T16:06:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pfsense-rest-api-priv-esc/","summary":"Authenticated users with the 'Scoped HA Settings Sync' permission can exploit CVE-2026-113779 in pfSense-pkg-RESTAPI versions prior to 2.9.0 to modify API configuration secrets and achieve full administrative privilege escalation.","title":"pfSense-pkg-RESTAPI: Privilege escalation via Scoped HA Settings Sync (CVE-2026-113779)","url":"https://feed.craftedsignal.io/briefs/2026-10-pfsense-rest-api-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - PfSense","version":"https://jsonfeed.org/version/1.1"}