CVE-2026-71490: OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

Description

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

High

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 32% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CO

core · opnsense

< 26.1.11 · source: vendor