pfSense REST API CVE-2026-113779

Exploitation requires (1) the unofficial pfSense-pkg-RESTAPI package installed at a version prior to 2.9.0, and (2) an authenticated account that has been explicitly granted the scoped 'settings sync' permission (api-v2-system-restapi-settings-sync-post). The attacker then abuses the /api/v2/system/restapi/settings/sync (HA settings sync) endpoint to modify REST API configuration secrets. Limiting factors: the sync privilege is a non-default, deliberately assigned permission, so fully unauthenticated users cannot exploit this; exposure is further reduced where REST API ACLs or firewall rules already restrict the API endpoints to trusted administrator and HA peer IP addresses. This is NOT exploitable against a default configuration with no scoped-permission accounts.

This is a genuine high-priority issue for environments running the affected package, but the risk is bounded by a meaningful precondition. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity attack requiring low-level authentication, with full confidentiality/integrity/availability impact - consistent with the described escalation of a non-administrative user to full administrator. The PR:L metric is well-justified: exploitation requires an existing authenticated account that specifically holds the dedicated 'settings sync' permission (api-v2-system-restapi-settings-sync-post), so this is not an anonymous remote attack but an insider/post-authentication privilege-boundary failure. No EPSS score was provided, so exploitation probability cannot be quantified from the input. The CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The CWE-502 (deserialization) classification aligns with the vendor's note of a 'weak deserialization pattern,' indicating the escalation is achieved by abusing the sync endpoint to inject/modify configuration secrets. Net: a real priority for the subset of pfSense deployments that have installed this unofficial package AND granted the sync permission to non-admins - but mitigated by the fact that it is not exploitable by arbitrary unauthenticated users and the permission is not granted by default.

An organization grants a semi-trusted operator the scoped 'settings sync' REST API permission for HA configuration tasks. That operator sends authenticated requests to the /api/v2/system/restapi/settings/sync endpoint to modify REST API configuration secrets, abusing the weak deserialization/access-control gap to elevate their account to full administrator. No user interaction is required and attack complexity is low, but the attacker must already possess a valid account with the sync privilege; no public exploit code is known.