pfrest CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH pfrest CVE published 2026-10-21

CVE-2026-113779

The pfSense REST API package is vulnerable to privilege escalation via scoped HA settings sync permission. Authenticated accounts with the dedicated settings sync permission can modify REST API configuration secrets, allowing non-administrative users to elevate their privileges to a full administrator. The issue is patched in version 2.9.0, which also includes hardening measures.