Safing Portmaster before version 2.2.5 includes a missing authorization check that allows any local process to call the POST /api/v1/updates/from-url endpoint. An attacker can specify an attacker‑controlled index URL, and the update service ignores version constraints and auto‑apply settings, installing an older Safing‑signed release that may contain previously fixed vulnerabilities. The result is a downgrading of the application to a version that can be compromised by known flaws, potentially compromising the integrity and confidentiality of the host environment.

The vulnerability affects Safing Portmaster installations below version 2.2.5. Users running any earlier 2.2.x release are at risk. Current official releases prior to the v2.2.5 tag are the only impacted products.

With a CVSS score of 4.8 the risk is moderate. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The exploitation requires a local, unauthenticated process that can reach the API; no network‑based attack vector is necessary. Because any user with write access to the local machine can trigger the downgrade, the attack is practically trivial on an affected host but is limited to systems where Portmaster is installed and exposing the endpoint.