Advisory · CVE-2026-111231
Read-only pfSense users can replace the firewall configuration despite a deny-write privilege
An authorization bypass in pfSense CE through 2.9.0 lets read-only WebGUI users replace config.xml because the restore and install paths ignore the deny-config-write privilege, leading to root-level code execution after reload or reboot. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
- Vendor
- Netgate
- Product
- pfSense CE
- Identifier / CWE
- CVE-2026-111231
CWE-863 - Action timing
- Immediate
Explain it like I’m five
An account that is explicitly forbidden from writing configuration can still hand the firewall a whole new configuration file, and the firewall adopts it.
- 01Read-only user reaches backup pages
A WebGUI user holding page privileges for backup or restore functions, but denied config write, opens the restore path.
- 02Authorization check skipped
The config restore and install functions ignore the deny-config-write privilege.
- 03Crafted config installed
The user installs a chosen config.xml.
- 04Root code after reload
After a reload or reboot, the installed configuration yields root-level code execution.
What happened
Disclosure records published October 15, 2026 describe an incorrect authorization vulnerability (CWE-863) in Netgate pfSense CE through 2.9.0. The config restore and config install functions ignore the ‘User - Config: Deny Config Write’ privilege, so read-only WebGUI users who can reach the backup, restore, or auto-config-backup pages can install a chosen config.xml.
The score comes from the CVSS 4.0 assessment (8.6) in the disclosure record; the CVSS 3.1 assessment in the same record is 7.2 because the attacker must already hold a privileged WebGUI account. Treat this as an admin-account containment issue: it matters most where WebGUI privileges are shared, stale, or broader than intended.
What to do
- Inventory pfSense CE firewalls and confirm each one’s version against the affected range in the vendor-side record above.
- Apply the Netgate fix or upgrade for this issue as soon as a fixed release or patch is available, and use the System Patches mechanism where Netgate directs.
- Restrict WebGUI access to a dedicated management network and named admin accounts while remediation is underway.
- Audit the configuration and logs for configuration restores or installs performed by accounts holding the deny-config-write privilege, and config changes without a matching admin change record.
- Review admin and read-only accounts, remove stale ones, and rotate credentials for any account that could have used this path.
- Verify the firewall version or patch state after remediation.
Management note
This is the most serious of the pfSense batch because it breaks the read-only boundary that auditors and NOC staff rely on. If read-only accounts exist, assume this path was available to all of them and review config history.