CVE-2026-71490

7.1High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-863

Impact

Authenticated users with read-only restrictions can bypass them to modify component configurations via MVC APIs. Attackers need valid low-privileged credentials directly assigned both a write privilege and user-config-readonly.

Root cause

The ACL checker fails to split directly assigned comma-separated privileges before evaluating user-config-readonly, causing exact string matches to miss the read-only restriction.

Affected systems

OPNsense versions prior to 26.1.11

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Fix & remediation

Upgrade to OPNsense 26.1.11 or later. As an interim workaround, assign privileges exclusively through groups instead of directly to user accounts, or remove write privileges from read-only users.

shell

$ opnsense-update

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-71490