The pfSense REST API package before version 2.9.0 contains a privilege escalation flaw that allows an authenticated user with the dedicated settings‑sync permission to modify REST API configuration secrets, effectively elevating a non‑administrator to full administrative rights. The vulnerability arises from improper access control, classified under CWE‑502.

This flaw affects the pfSense-pkg-RESTAPI package developed by pfrest. Any instance running a version earlier than 2.9.0 is vulnerable; the patch is supplied in the 2.9.0 release and later versions.

The vulnerability carries a CVSS score of 8.8, indicating high severity. No EPSS score is publicly available, and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the REST API and the presence of the settings‑sync permission; however, once exploited, the attacker gains full administrative control over the firewall. The lack of an EPSS value means the precise likelihood of exploitation is unknown, but the high CVSS score suggests a potentially severe impact if the vulnerability is abused.