CVE-2026-71490Published
OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-71490 · Microsoft / collected KEV context
cve-program · CVE-2026-71490
- https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw
- https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505
- https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9
- https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.