OPNsense users assigned both a component write privilege and a user‑config‑readonly privilege can, through a parsing flaw, bypass the system’s read‑only enforcement. This flaw allows the affected user to persist configuration changes that should be forbidden, potentially altering firewall rules, interfaces, and other sensitive settings without appropriate authorization. The vulnerability is identified as CWE‑863, indicating an access control weakness that permits improper privilege granting.

The vulnerability applies to the OPNsense core firewall platform on all releases prior to 26.1.11. After the 26.1.11 update, the issue is fixed and no longer present. All users with the affected privilege combination on older releases are at risk.

With a CVSS score of 7.1 the flaw is considered high severity, but the EPSS score indicates a very low likelihood of exploitation (< 1 %). The flaw is not listed in the CISA KEV catalog. The likely attack path involves an authenticated user with overlapping write and read‑only privileges, suggesting that internal or compromised accounts may exploit the issue. Once bypassed, the attacker can change protected configuration via MVC API calls, impacting confidentiality and integrity of network policies.