CVE-2026-111664: Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

Q: Who can exploit this issue?

Any unprivileged local process able to call Portmaster's local API can invoke the affected endpoint. The attacker does not need authentication, but must already have code execution on the machine.

Q: What must an attacker provide to perform the downgrade?

The attacker supplies an attacker-controlled update index URL to the POST /api/v1/updates/from-url endpoint. This can bypass normal version checks and auto-apply settings to install an older Safing-signed release.

Q: Are default update protections sufficient to prevent exploitation?

No. The affected endpoint can bypass version checks and auto-apply settings, so those controls do not prevent the forced downgrade described.

Q: How can I determine whether a system is affected?

Systems running Safing Portmaster before version 2.2.5 are affected. Review whether local processes can access the POST /api/v1/updates/from-url API endpoint and whether Portmaster has been unexpectedly downgraded to an older signed release.

Published Oct 16, 2026

Updated

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.

Affected Software

1 affected component

Safing Portmaster<2.2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Safing Portmaster to a version that resolves this vulnerability.
Fixed in 2.2.5

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unprivileged local process able to call Portmaster's local API can invoke the affected endpoint. The attacker does not need authentication, but must already have code execution on the machine.

What must an attacker provide to perform the downgrade?

The attacker supplies an attacker-controlled update index URL to the POST /api/v1/updates/from-url endpoint. This can bypass normal version checks and auto-apply settings to install an older Safing-signed release.

Are default update protections sufficient to prevent exploitation?

No. The affected endpoint can bypass version checks and auto-apply settings, so those controls do not prevent the forced downgrade described.

How can I determine whether a system is affected?

Systems running Safing Portmaster before version 2.2.5 are affected. Review whether local processes can access the POST /api/v1/updates/from-url API endpoint and whether Portmaster has been unexpectedly downgraded to an older signed release.

CVE-2026-111664: Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What must an attacker provide to perform the downgrade?

Are default update protections sufficient to prevent exploitation?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What must an attacker provide to perform the downgrade?

Are default update protections sufficient to prevent exploitation?

How can I determine whether a system is affected?