OPNsense CVE-2026-58395

Requires an authenticated OPNsense user (PR:L) holding at least one of the affected module privileges - Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP - who can then reach any of the 21 affected delete endpoints backed by ApiMutableModelControllerBase::delBase(). No special non-default configuration or user interaction is needed, but exploitation is strictly limited to instances running a version prior to 26.1.11 and to accounts that already possess at least one of those module privileges; the flaw yields a read-only configuration oracle and cannot modify config or delete data, which bounds its impact to confidentiality.

This is a genuine but modest-severity information-disclosure issue, correctly rated 4.3 (medium). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is internally consistent with the description: network-reachable API (AV:N), trivial crafting of a token (AC:L), requires an authenticated user holding at least one affected module privilege (PR:L), no user interaction (UI:N), and limited confidentiality impact with no integrity or availability effect (C:L/I:N/A:N) - matching the statement that the request neither modifies configuration nor performs a deletion. No EPSS score, KEV listing, or POC flag was provided in the input, so exploitation probability signals are absent rather than low; no public exploit identified at time of analysis. The practical risk is cross-module configuration reconnaissance: an XPath injection (CWE-643) turns 21 delete endpoints into a substring-presence oracle leaking item names, descriptions, reference paths, and UUIDs even for modules the account cannot normally access. This is an authenticated privilege-boundary bypass useful for lateral discovery, not a standalone critical flaw - real priority is driven by whether low-privilege operator accounts exist on an OPNsense instance. The hackerask.com reference and two fix commits are the only external corroboration; there is no indication of active exploitation.

A low-privileged OPNsense operator who has been granted only a single module privilege (for example Dnsmasq or DHCP relay) sends a crafted safe-delete token to one of the 21 affected delete endpoints. Because the token is interpolated into an XPath query over config.xml before validation, the resulting error response reveals configuration item names, descriptions, reference paths, and UUIDs from modules the operator is not authorized to see, and the endpoint can be used iteratively as a substring-presence oracle. No public exploit code was identified in the provided data, though the fix commits publicly disclose the vulnerable code path.