---
id: "CVE-2026-113779"
kind: "vulnerability"
aliases: ["CVE-2026-113779"]
title: "pfSense REST API package: sync-permission users can escalate to admin"
severity: "high"
cvss: 8.8
epss: 0.0041
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["firewall", "package", "pfsense", "rest-api", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-21T15:17:16+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113779", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113779", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# pfSense REST API package: sync-permission users can escalate to admin

The pfSense REST API package before 2.9.0 lets an account holding the settings sync permission change REST API configuration secrets. An attacker with that account can raise their privileges to full administrator on the firewall.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

Upgrade the pfSense-pkg-RESTAPI package to 2.9.0 or later. As a workaround, remove the api-v2-system-restapi-settings-sync-post privilege from non-administrative users and restrict API access with ACLs or firewall rules to trusted admin and HA peer IPs.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113779
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113779

## From the sources

The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. pfSense-pkg-RESTAPI 2.9.0 patches the issue. Access to the HA settings sync endpoint now strictly requires full administrative privileges (`page-all`). The sub-administrative sync privilege has been removed in versions v2.9.0 and later. In addition to correcting the access control boundary, version 2.9.0 includes the following hardening measures: opt-in default and format and validation modernization. As a workaround, one may mitigate exposure by taking either or all of the following steps. Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrator and HA peer IP addresses.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_