Vulnerability · GHSA-x3q7-cc7h-gj3v
Password-policy lock is cleared by an empty-password Save on system_usermanager_passwordmg.php (CWE-863/696)
Published Sep 30, 2026 · catalog updated Oct 5, 2026 · Password-policy lock is cleared
Last checked Nov 2, 2026. A connected source was read within the last 7 days.
Open the advisory
Exploitation likelihood is not on this record for GHSA-x3q7-cc7h-gj3v. A missing EPSS score is not a low risk. Compare Password-policy lock is cleared with the linked advisory before you change production.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Password-policy lock is cleared).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- EPSS is missing. A missing score is not a low risk.
- Severity
- Medium4.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- Awaiting synchronization with FIRST
- Remediation
- Version ranges on file
- Affected products
- other opnsense/core
### Summary When a local user's password violates the configured policy (length/complexity/age), sets and confines the session to the password portal ( , user portal). The only intended way off that lock is a successful . documents *"we can continue without a password if nothing was provided"* (language-only Save). That path leaves empty, then **unconditionally** at line 113 **before** the password-write branch at 118 (which does not run when both fields are empty). The weak/expired password is unchanged. Subsequent GUI/API requests use the account's normal privileges. This is **not** unauthenticated access and **not** cross-account privilege escalation. The operator must already hold that user's password (PR:L). Independent reflection rated it **low**: the user can also leave the lock by actually changing the password; the bug is that the lock can be dropped without changing it, so a policy-violating credential stays valid and records a normal "Saved settings" revision. Q8: distinct from GHSA-h3vx-4q27-rc42 (authentication lockout bypass) and from issue #9857 ( not updated on the User model). ### Affected versions - Verified on opnsense/core commit (CORE_ABI 26.7). - empty-field branch is present on that snapshot. ### PoC (observed, isolated 127.0.0.1:13281) PHP 8.3 serving unmodified . Policy: , length 12, complexity on. User stored password (violates policy). CSRF token from the portal form. Responses below are captured, not expected. 1. **Lock live** — after login, **Observed:** Same for . 2. **Normal** — POST new compliant password ( , ) **Observed:** Session flag absent; . → **200** (dashboard, 90127 bytes). 3. **Failure** — POST language-only Save, empty / , valid CSRF **Observed:** Session flag **absent**; stored hash still ( ). shim log empty ( never ran). → **200** dashboard (90127 bytes); → **200**. Unauthenticated remains the login form only. 4. **Patched (lab only)** — move the inside the successful branch. Source restored byte-identical. Empty POST rep
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- other opnsense/core<= 26.7.4, 26.4.2p2
How to fix GHSA-x3q7-cc7h-gj3v
Upgrade
GHSA-x3q7-cc7h-gj3v lists a fix boundary at 26.7.4. Compare the installed build with that boundary before you change production.
Version check
Affected <= 26.7.4
Advisory
Open the inventory_github record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
Exploitation likelihood is not on this record for GHSA-x3q7-cc7h-gj3v. A missing EPSS score is not a low risk. Compare Password-policy lock is cleared with the linked advisory before you change production.
Which versions are affected?
Compare what you have installed with <= 26.7.4, 26.4.2p2. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-696; CWE-863: Incorrect Authorization. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 30, 2026 · Maintainer security tabs
Detected
### Summary When a local user's password violates the configured policy (length/complexity/age), sets and confines the session to the password portal ( , user portal). The only intended way off that lock is a successful . documents *"we can continue without a password if nothing was provided"* (language-only Save). That path leaves empty, then **unconditionally** at line 113 **before** the passwor
Oct 5, 2026 · Maintainer security tabs
Updated
### Summary When a local user's password violates the configured policy (length/complexity/age), sets and confines the session to the password portal ( , user portal). The only intended way off that lock is a successful . documents *"we can continue without a password if nothing was provided"* (language-only Save). That path leaves empty, then **unconditionally** at line 113 **before** the passwor
Sources
- Maintainer security tabsVendor advisoryGHSA-x3q7-cc7h-gj3v
### Summary When a local user's password violates the configured policy (length/complexity/age), sets and confines the session to the password portal ( , user portal). The only intended way off that lock is a successful . documents *"we can continue without a password if nothing was provided"* (language-only Save). That path leaves empty, then **unconditionally** at line 113 **before** the passwor
github.com
Freshness
Last verified in this catalog Oct 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- Maintainer security tabsNov 2, 2026