CVE-2026-113779: CWE-502: Deserialization of Untrusted Data in pfrest pfSense-pkg-RESTAPI

The pfSense-pkg-RESTAPI package prior to 2.9.0 contains a CWE-502 deserialization of untrusted data vulnerability that enables privilege escalation. Specifically, authenticated users with the dedicated settings sync permission (a sub-administrative privilege) can modify REST API configuration secrets, effectively elevating their privileges to full administrator. The vulnerability is fixed in version 2.9.0 by removing the sub-administrative sync privilege and enforcing that access to the HA settings sync endpoint requires full administrative rights (`page-all`). The update also includes opt-in defaults and improved validation to harden the API. Mitigation can be achieved by revoking the vulnerable permission from non-admin users and restricting API endpoint access to trusted IPs.

This vulnerability allows an authenticated user with limited privileges (settings sync permission) to escalate to full administrator privileges. This can lead to complete compromise of the pfSense firewall's REST API configuration, potentially impacting confidentiality, integrity, and availability of the firewall management interface and its settings.

A fix is available in pfSense-pkg-RESTAPI version 2.9.0, which removes the sub-administrative settings sync permission and requires full administrative privileges for the HA settings sync endpoint. Users should upgrade to version 2.9.0 or later. As a workaround before upgrading, revoke the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users. Additionally, configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict API endpoint access to trusted administrator and HA peer IP addresses.