GHSA-2w8j-hpp2-8rfj

An authenticated user with only System: Status can dismiss the hidden Crash Reporter status and delete crash files. A read-only user with Crash Reporter visibility can also delete them. Reproduced on OPNsense Community 26.7.8_2 amd64.

SystemController::dismissStatusAction() accepts the request when isPageAccessible(...) OR the user lacks user-config-readonly. CrashReporterStatus::dismissStatus() unlinks /var/crash/* and /var/lib/php/tmp/PHP_errors.log. A Status-only user lacks access to the Crash Reporter status but passes the second condition. The read-only test user passes the first condition. Relevant source: src/opnsense/mvc/app/controllers/OPNsense/Core/Api/SystemController.php and src/opnsense/mvc/app/library/OPNsense/System/Status/CrashReporterStatus.php. Suggested fix: require the relevant page permission and reject read-only users before destructive dismissal.