diff --git a/0070-v2.5.0-fix-policy-use-PK_ACTION_CONFIG-for-set-ZoneSettings.patch b/0070-v2.5.0-fix-policy-use-PK_ACTION_CONFIG-for-set-ZoneSettings.patch
new file mode 100644
index 0000000..14a5e94
--- /dev/null
+++ b/0070-v2.5.0-fix-policy-use-PK_ACTION_CONFIG-for-set-ZoneSettings.patch
@@ -0,0 +1,37 @@
+From 2fb1b1da56a68566e69c1ce9b5e1f7074399c1f5 Mon Sep 17 00:00:00 2001
+From: Sizhe Zhao <prc.zhao@outlook.com>
+Date: Tue, 31 Mar 2026 20:46:50 +0800
+Subject: [PATCH] v2.5.0: fix(policy): use PK_ACTION_CONFIG for
+ set{ZoneSettings2,PolicySettings}
+
+Reference: https://access.redhat.com/security/cve/cve-2026-4948
+(cherry picked from commit 5fb3914ad830feff6cb2b0670457c60a323c6c6c)
+---
+ src/firewall/server/firewalld.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py
+index e43ddb959f41..d47f50116f0e 100644
+--- a/src/firewall/server/firewalld.py
++++ b/src/firewall/server/firewalld.py
+@@ -946,7 +946,7 @@ class FirewallD(DbusServiceObject):
+         log.debug1("getZoneSettings2(%s)", zone)
+         return self.fw.zone.get_config_with_settings_dict(zone)
+ 
+-    @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
++    @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG)
+     @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sa{sv}')
+     @dbus_handle_exceptions
+     def setZoneSettings2(self, zone, settings, sender=None):
+@@ -970,7 +970,7 @@ class FirewallD(DbusServiceObject):
+         log.debug1("policy.getPolicySettings(%s)", policy)
+         return self.fw.policy.get_config_with_settings_dict(policy)
+ 
+-    @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
++    @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG)
+     @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='sa{sv}')
+     @dbus_handle_exceptions
+     def setPolicySettings(self, policy, settings, sender=None):
+-- 
+2.53.0
+
diff --git a/firewalld.spec b/firewalld.spec
index d2d0a86..e8d8fff 100644
--- a/firewalld.spec
+++ b/firewalld.spec
@@ -1,7 +1,7 @@
 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
 Name: firewalld
 Version: 1.3.4
-Release: 19%{?dist}
+Release: 20%{?dist}
 URL:     http://www.firewalld.org
 License: GPLv2+
 Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.bz2
@@ -74,6 +74,7 @@ Patch66: 0066-v2.5.0-chore-fw_policy-support-timeouts.patch
 Patch67: 0067-v2.5.0-fix-policy-support-timeouts.patch
 Patch68: 0068-v2.5.0-fix-cli-policy-allow-timeout-with-ingress-zon.patch
 Patch69: 0069-v2.5.0-test-policy-verify-timeout-works.patch
+Patch70: 0070-v2.5.0-fix-policy-use-PK_ACTION_CONFIG-for-set-ZoneSettings.patch
 BuildArch: noarch
 BuildRequires: autoconf
 BuildRequires: automake
@@ -297,6 +298,9 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
 %{_mandir}/man1/firewall-config*.1*
 
 %changelog
+* Wed Jul 26 2026 Eric Garver <egarver@redhat.com> - 1.3.4-20
+- fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings} (CVE-2026-4948)
+
 * Fri Jul 10 2026 Eric Garver <egarver@redhat.com> - 1.3.4-19
 - fix(zone): forward: support timeout
 - fix(policy): support timeouts