Privilege Escalation Vulnerability in pfSense Firewall REST API

CVE-2026-113779

What is CVE-2026-113779?

The pfSense REST API package, an unofficial open-source tool for pfSense CE and pfSense Plus firewalls, is vulnerable to a privilege escalation flaw. Authenticated users with settings sync permissions can manipulate API configuration secrets, potentially granting them administrator-level access. This risk is mitigated in version 2.9.0, which enforces strict access controls requiring full administrative privileges to access the HA settings sync endpoint. To further secure the system, it's recommended to revoke the api-v2-system-restapi-settings-sync-post privilege from non-administrative users and to implement Access Control Lists (ACLs) and firewall rules that limit API access to trusted IPs.

References