CVE-2026-111664

Medium

Description

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities.

SeverityMedium

CVSS4.4

Exploit probability—

ProductSafing Portmaster

PublishedOct 16, 2026

First seenOct 16, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

safing portmaster2.2.5 or later

Patches

github.com/safing/portmaster/commit/f943e1eaf98f45bc48490bf288e1d63c04929ae0

Vendor advisories

github.com/safing/portmaster/releases/tag/v2.2.5

Affected products

Product	Affected versions	Fixed in
safing portmaster	v < 2.2.5	2.2.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.