pfSense-pkg-RESTAPI: Privilege escalation via HA settings sync permission
Summary
The pfSense REST API package, an unofficial open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls, contains a privilege escalation flaw in the HA settings sync endpoint. An authenticated user who has been granted the narrow settings sync permission can change the REST API JWT signing secret, forge an administrative session and gain full administrator rights. Exploitation requires that an administrator has assigned this permission and that the REST API ACLs do not restrict the account to trusted HA peers.
Affected
- pfSense-pkg-RESTAPI prior to v2.9.0 (GitHub advisory: up to and including v2.8.4)
- Only environments where the api-v2-system-restapi-settings-sync-post permission was assigned to non-administrative users and the REST API ACLs do not limit access to trusted HA peers
Fixed in
- Upgrade to pfSense-pkg-RESTAPI v2.9.0 or later. Later releases are also available; the upstream project recommends the latest version.
- Note: v2.9.0 requires the hasync_username to hold page-all privileges for HA sync and requires hasync to be enabled on remote HA peers.
Workaround
- Remove the api-v2-system-restapi-settings-sync-post permission from all non-administrative users.
- Restrict API access with REST API ACLs and/or firewall rules so that only trusted administrators and HA peer IP addresses can reach the API.
Exploitation
- Known exploited (KEV): not listed.
- Public proof of concept: none found in the advisory or research sources.
- In the wild: no reports of active exploitation found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade pfSense-pkg-RESTAPI to v2.9.0 or later. Test HA setups first, because reported issues exist with HA sync and the system update UI on pfSense 2.9.
- Until the upgrade is complete, remove the sync permission from non-administrative accounts and restrict API access to trusted administrators and HA peers.
- Review which accounts hold API permissions and audit them regularly.
- Monitor API logs for settings sync requests from non-administrative accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8q8g-9f77-8g8g github.com
- pfSense REST API v2.9.0 release notes github.com
- pfSense REST API v2.10.0 release notes github.com
- pfSense REST API releases github.com
- OpenCVE CVE-2026-113779 app.opencve.io
- VulDB entry 424828 vuldb.com
- Vulners OSV CVE-2026-113779 vulners.com
- Strix CVE-2026-113779 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:13.
Original description (NVD)
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.