CVE-2026-113779 pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission

The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST...

CVE-2026-113779

The pfSense REST API package (pfSense-pkg-RESTAPI) is vulnerable to a privilege escalation flaw in versions prior to 2.9.0 . Authenticated accounts with the dedicated settings sync permission can modify REST API configuration secrets, allowing a non-administrative user to gain full administrator ...