CVE-2026-71490 Details
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.
A vulnerability in OPNsense prior to version 26.1.11 allows users with certain privileges to bypass read-only restrictions and make unauthorized configuration changes. The issue arises in the ACL privilege handling, where comma-separated privilege values assigned directly to users are not properly split before comparison. This flaw can be exploited by users who have both write privileges for a component and the 'user-config-readonly' privilege, enabling them to manipulate settings through MVC APIs that should be protected by the read-only constraint.
Users can update to OPNsense version 26.1.11 or 26.4.1p1, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505 | [email protected] | Source CodeVendor |
| https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9 | [email protected] | Source CodeVendor |
| https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034 | [email protected] | Source CodeVendor |
| https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OPNsense | <= 26.1.10 (semver) <= 26.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | New CVE Received | [email protected] |
| Oct 15, 2026 | CVE Modified | CISA-ADP |