CVE-2026-111664CWE-306

CVE-2026-111664

Medium · published October 16, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
1.5
In the wild
Unconfirmed
What it is

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00116 · 1.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-16T22:17Z
References (5)
https://github.com/safing/portmaster/blob/v2.2.3/service/core/api.go#L145-L159 · [email protected]https://github.com/safing/portmaster/commit/f943e1eaf98f45bc48490bf288e1d63c04929ae0 · [email protected]https://github.com/safing/portmaster/issues/2292 · [email protected]https://github.com/safing/portmaster/releases/tag/v2.2.5 · [email protected]https://www.vulncheck.com/advisories/safing-portmaster-before-2.2.5-unauthenticated-forced-downgrade-via-api-v1-updates-from-url · [email protected]
EPSS history
Timeline
  • 18 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 16 OCT 17:39Z
    Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url
    cvelistv5
  • 16 OCT 17:39Z
    Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url
    cvelistv5