CVE-2026-71490: OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OPNsenseto a version that resolves this vulnerability.Fixed in 26.1.11
Event History
Frequently Asked Questions
Which users are exposed to this bypass?
The issue affects users who are directly assigned a comma-separated privilege value containing both a component write privilege and user-config-readonly. Users receiving those privileges through a group are not affected by this specific parsing flaw.
What access does an attacker need to exploit it?
An attacker needs an existing low-privileged user account with the affected direct privilege assignment. No user interaction is required, and the vulnerable MVC API must be protected by throwReadOnly() for the relevant component.
What is the impact of a successful exploit?
The affected user can be treated as not subject to the read-only restriction and can persist configuration changes through MVC APIs for the component associated with their write privilege. The supplied severity vector indicates integrity impact and limited availability impact, with no confidentiality impact.
How can I remediate or identify affected configurations?
Update OPNsense to version 26.1.11. Before updating, review directly assigned user privileges for comma-separated values that combine a component write privilege with user-config-readonly; group-based privilege assignments do not have the same issue.