CVE-2026-71490

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11

Description In the OPNsense firewall and routing platform, the hasPrivilege() function within OPNsenseCoreACL incorrectly processes directly assigned comma-separated <priv> values by treating them as a single string during the user-config-readonly check. This allows a user who is assigned both a component write privilege and the user-config-readonly restriction to bypass the read-only limitation. Consequently, MVC APIs protected by the throwReadOnly() function may allow the persistence of configuration changes for that specific component. This parser flaw does not affect group privileges as they are split correctly.

Recommendations Update to version 26.1.11.