This vulnerability allows an attacker to execute authenticated CSRF attacks against OPNsense. Multiple MVC API endpoints can perform state‑changing operations when accessed with HTTP GET requests without CSRF validation. A malicious website can cause an authenticated user to trigger privileged backend actions, resulting in unintended service reloads and configuration changes via configd. The primary impact is the ability to alter system configuration while the user is authenticated, which can lead to denial of service or other unintended behavior.

All OPNsense core installations with versions prior to 26.1.4 are affected. The vendor identified the product as opnsense:core. The specific affected releases are those older than 26.1.4, as noted in the vendor advisory.

The CVSS score of 6.3 indicates a medium severity vulnerability. The EPSS score is below 1%, suggesting that current exploitation attempts are low. The vulnerability is not listed in the CISA KEV catalog. Exposition requires an authenticated session; the attack vector is a web-based CSRF triggered by a malicious site. Because the attacker needs a legitimate authenticated user to visit a malicious site, exploitation likelihood depends on user behavior and threat actor resources