GHSA-2f7g-25f3-55v7

A user with direct Monit access and a page-all group restricted to another source network can save Monit settings from a disallowed source, although ordinary full-admin routes are unavailable there. Reproduced on OPNsense Community 26.7.8_2 amd64.

Core/ACL.php applies group source_networks in urlMasks() for route access, but hasPrivilege() counts group privileges without that source check. Monit/Api/SettingsController.php sets internalSaveRequiresAdmin=true; the base save path calls throwNotFullAdmin(), which uses hasPrivilege(username, page-all). Relevant source: src/opnsense/mvc/app/models/OPNsense/Core/ACL.php; src/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php; src/opnsense/mvc/app/controllers/OPNsense/Base/ApiMutableModelControllerBase.php; src/opnsense/mvc/app/controllers/OPNsense/Monit/Api/SettingsController.php. Suggested fix: evaluate effective group privileges for the current client source in the full-admin check.