Pfsense User Manager Page

[ergungunduz]

Hi,

I am triying to create a new user.I Firtly, I created one group which Privilege is  "WebCfg - System: User Manager page" selected. Then I created 1 user. when we login with this user,User can change the administrator password. I tried "WebCfg - System: Login / Logout page / Dashboard " but it is not allowed the create a new user. I want that User can create a new user but not change the administrator username and its password.

Is it possible in pfsense??

[jimp]

That is not currently possible.

[ergungunduz]

Thank you for your reply jimp.

But I am thinking how it is not possible. This is security vulnerability for pfsense. I hope It should be solved as soon as possible.

[jimp]

It is not a vulnerability, it's a limitation in the user manager. If you don't want someone to change another user's password, don't give them the ability to manage users.