CVE-2026-30868

CVE-2026-30868 affects OPNsense (FreeBSD-based firewall) prior to 26.1.4. Several MVC API endpoints perform state-changing actions over HTTP GET without CSRF protection. The ApiControllerBase CSRF validation only covers POST/PUT/DELETE, allowing an authenticated user’s browser to trigger privileg...