pfSense REST API Patch 2.9.0 Stops Privilege Escalation for Sync Users

The pfSense-pkg-RESTAPI package version 2.9.0 addresses a high-severity privilege escalation flaw. This update restricts access to the HA settings sync endpoint, requiring full administrative privileges instead of the previously available sub-administrative sync right.

What happened

The pfSense REST API package is an unofficial, open-source tool providing REST and GraphQL interfaces for pfSense CE and pfSense Plus firewalls. According to the National Vulnerability Database record for CVE-2026-113779, this package contains a flaw rated CVSS 8.8 HIGH.

Prior to version 2.9.0, the vulnerability allows authenticated accounts holding the dedicated settings sync permission to modify REST API configuration secrets. This enables a non-administrative user to elevate their privileges to a full administrator. The weakness is classified under CWE-502.

As Patch Gazette reported on 2026-10-18, privilege escalation flaws in plugins like Brainstorm Force OttoKit have previously allowed similar unauthorized access. Similarly, on 2026-10-16, a patch for Rdiffweb fixed a high-severity issue where authenticated users could elevate privileges by modifying a role parameter.

The pfSense-pkg-RESTAPI 2.9.0 release patches the issue by removing the sub-administrative sync privilege in versions v2.9.0 and later. Access to the HA settings sync endpoint now strictly requires full administrative privileges, specifically the `page-all` permission.

Version 2.9.0 also includes hardening measures such as an opt-in default configuration. The update brings format and validation modernization to the package, correcting the access control boundary that previously allowed the escalation.

Why it matters

This flaw affects the boundary between standard users and administrators in firewalls using the REST API package. The source states that modifying REST API configuration secrets enables a non-administrative user to elevate their privileges to a full administrator.

The impact is significant because pfSense is widely used for network security. The vulnerability allows a specific type of authenticated account to bypass intended access controls. The unofficial nature of the package means it is not part of the core pfSense distribution, requiring separate management.

The removal of the specific `api-v2-system-restapi-settings-sync-post` privilege eliminates the direct vector for this attack. By enforcing stricter access controls, the update ensures that only fully trusted administrators can interact with sensitive synchronization endpoints.

What to watch

• Monitor pfSense community forums for reports of exploitation attempts targeting the REST API package.
• Check internal logs for unauthorized modifications to API configuration secrets or sync endpoints.
• Review user permissions to ensure no non-administrative accounts hold the settings sync privilege.
• Watch for announcements regarding other unofficial pfSense packages with similar access control weaknesses.

Who needs to act first

Teams usually prioritize systems exposed to untrusted networks or those handling sensitive data. Check whether any non-administrative users currently hold the settings sync permission. Revoke these rights immediately to reduce exposure while preparing for the update. Back up current firewall configurations before making changes. Test the update in a non-production environment to ensure compatibility with existing automation scripts and integrations. Roll out the fix to critical infrastructure first.

Background: APIs

APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.

Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches

What to do and how to stay safe

• Audit all user accounts to identify those with the `api-v2-system-restapi-settings-sync-post` privilege.
• Revoke the settings sync permission from all non-administrative users immediately.
• Configure REST API Access Control Lists to restrict endpoint access to trusted administrator IP addresses.
• Apply firewall rules to limit access to the API endpoints to known HA peer IP addresses.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which pfSense REST API versions are vulnerable to CVE-2026-113779?

All versions of pfSense-pkg-RESTAPI prior to 2.9.0 are affected by this vulnerability.

What is the CVSS score for this privilege escalation flaw?

The National Vulnerability Database rates CVE-2026-113779 as CVSS 8.8 HIGH.