CVE-2026-71490 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...