CVE-2026-111664

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111664

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111664.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111664

Published

2026-10-16T17:39:27Z

Modified

2026-10-17T02:48:44Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

Details

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111664.json"
}

References

Affected packages

Git / github.com/safing/portmaster

Affected ranges

Type

GIT

Repo

https://github.com/safing/portmaster

Events

Introduced

Fixed

67b684cd0c743a4f880f1a7a500bb43c8f3e7da8

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.2.5"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.1.0

v0.2.1

v0.2.2

v0.2.3

v0.2.5

v0.4.0

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.14

v0.4.15

v0.4.16

v0.4.17

v0.4.18

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.4.9-0.3.5

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.6.0

v0.6.1

v0.6.10

v0.6.11

v0.6.12

v0.6.13

v0.6.14

v0.6.15

v0.6.16

v0.6.17-beta

v0.6.18

v0.6.19

v0.6.2

v0.6.20

v0.6.21

v0.6.22

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.6.8

v0.6.9

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.19

v0.7.2

v0.7.20

v0.7.21

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.1

v0.8.10

v0.8.11

v0.8.12

v0.8.13

v0.8.14-interdep

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.8.9-interdep

v0.9.0

v0.9.1

v0.9.1-interdep

v0.9.10

v0.9.11

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

v1.*

v1.0.0

v1.0.1

v1.0.10

v1.0.11

v1.0.12

v1.0.13

v1.0.14

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.0.6

v1.0.7

v1.0.8

v1.0.9

v1.1.0

v1.2.0

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.3.4

v1.3.5

v1.3.6

v1.4.0

v1.4.1

v1.4.10

v1.4.11

v1.4.2

v1.4.3

v1.4.4

v1.4.5

v1.4.6

v1.4.6-prep2

v1.4.7

v1.4.8

v1.4.9

v1.5.0

v1.5.1

v1.6.0

v1.6.1

v1.6.10

v1.6.11

v1.6.12

v1.6.13

v1.6.14

v1.6.15

v1.6.16

v1.6.17

v1.6.18

v1.6.19

v1.6.2

v1.6.20

v1.6.21

v1.6.22

v1.6.23

v1.6.24

v1.6.3

v1.6.4

v1.6.5

v1.6.6

v1.6.7

v1.6.8

v1.6.9

v2.*

v2.0.20

v2.0.21

v2.0.22

v2.0.23

v2.0.25

v2.1.18

v2.1.7

v2.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111664.json"