CVE-2026-71490

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.

• CWE-863

• https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505
• https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9
• https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034
• https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw
• https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7148A flaw has been found in CodeAstro Online Classroom 1.0. Thi…6.3
• CVE-2026-71483Horilla is an HR and CRM software. Prior to 1.6.0, the searc…8.5
• CVE-2026-71485Centrifugo is an open-source scalable real-time messaging se…9.1
• CVE-2026-71486vLLM is an inference and serving engine for large language m…4.3
• CVE-2026-71488league/commonmark is a PHP library for parsing and rendering…7.5
• CVE-2026-7149A vulnerability has been found in dexhunter kaggle-mcp up to…7.3
• CVE-2026-71491sqlparse is a non-validating SQL parser module for Python. P…8.7
• CVE-2026-71492Banks generates meaningful LLM prompts using a simple templa…6
• CVE-2026-71493Infracost provides cloud cost intelligence for engineers, AI…5.9
• CVE-2026-71494Infracost provides cloud cost intelligence for engineers, AI…5.9
• CVE-2026-71495Wanderer is a self-hosted trail database for saving and shar…10
• CVE-2026-71497jsoup is a Java library for working with real-world HTML. Fr…4.7