CVE-2026-113779 in pfSense-pkg-RESTAPI
Summary
by MITRE • 10/21/2026
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The pfSense package known as pfSense-pkg-RESTAPI provides an unofficial, open-source interface for managing firewalls via REST and GraphQL protocols. A critical privilege escalation vulnerability was identified in versions prior to 2.9.0, stemming from a flawed access control implementation within the high availability settings synchronization endpoint. This flaw allows authenticated users who possess only specific, limited permissions related to system configuration synchronization to modify sensitive REST API configuration secrets. By manipulating these secrets, an attacker with non-administrative privileges can effectively bypass security boundaries and elevate their status to that of a full administrator, thereby gaining complete control over the firewall infrastructure.
From a technical perspective, this vulnerability represents a classic case of broken access control where the principle of least privilege is violated. The system incorrectly granted write access to critical configuration data based on a scoped permission rather than requiring global administrative rights. This misconfiguration aligns with CWE-269, which describes Improper Privilege Management, and maps directly to MITRE ATT&CK technique T1078, Valid Accounts, specifically the sub-technique of using legitimate credentials that have been escalated through privilege abuse. The attacker exploits this by authenticating as a standard user or service account with sync permissions and then issuing requests to modify API secrets, which are typically used for securing internal communications between firewall nodes in a high availability cluster.
The operational impact of this vulnerability is severe, as it compromises the integrity and confidentiality of the entire network perimeter protected by pfSense. Once an attacker achieves administrative privileges through this method, they can alter routing tables, disable security rules, exfiltrate sensitive data, or install persistent backdoors. This undermines the fundamental purpose of a firewall to enforce security policies and protect internal networks from external threats. The ability to modify API secrets also poses a risk to high availability configurations, potentially disrupting service continuity if malicious changes are applied to cluster synchronization parameters.
To mitigate this vulnerability, immediate action is required for systems running versions earlier than 2.9.0. The recommended long-term solution is to upgrade the pfSense-pkg-RESTAPI package to version 2.9.0 or later. This update corrects the access control boundary by strictly requiring full administrative privileges, denoted as page-all, for any operations involving HA settings synchronization. Furthermore, the sub-administrative sync privilege has been removed in these newer versions, eliminating the attack vector entirely through architectural hardening.
For environments where immediate upgrading is not feasible, several workaround measures can be implemented to reduce exposure. First, administrators should revoke scoped permissions by removing the api-v2-system-restapi-settings-sync-post privilege from all non-administrative users who do not strictly require it for their operational duties. Second, network-level controls should be applied by configuring REST API Access Control Lists and firewall rules to restrict access to these sensitive endpoints exclusively to trusted administrator workstations and known high availability peer IP addresses. These steps help enforce a defense-in-depth strategy, ensuring that even if an attacker obtains valid credentials with limited privileges, they cannot reach the vulnerable endpoint without first bypassing additional network security controls.