Read the docs
TI-2026-75450 Aliases CVE-2026-111664GHSA-6952-c35h-6rff

Missing authorization in Safing Portmaster lets local processes force downgrades

Priority LOW 21CWE-306Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Safing Portmaster before 2.2.5 lacks authorization on the POST /api/v1/updates/from-url endpoint, which is registered with api.PermitAnyone. This missing authentication (CWE-306) lets unprivileged local processes force updates. An attacker supplies an attacker-controlled index URL that bypasses version checks and auto-apply settings, which installs older Safing-signed releases that carry previously fixed vulnerabilities. Exploitation requires local access with low privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00116 1st percentileScored 2026-11-07
Fix Fixed portmaster (safing): 2.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
safingportmasterbefore 2.2.52.2.5Patch availableCNA
  • portmaster Vendorsafing Affected before 2.2.5 Fixed in 2.2.5 Patch available CNA

Remediation

Update Safing Portmaster to version 2.2.5 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA portmaster (safing) Fixed in 2.2.5

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111664
  2. 2026-10-16 Alias added: GHSA-6952-c35h-6rff
  3. 2026-10-21 CISA SSVC decision points changed

References

Patch 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences