CVE-2026-48508
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Lemur before version 1.9.1 has the ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT flags disabled by default, causing the permission check to pass any authenticated user, including the read-only role. A user can create certificate authorities, upload certificates, create notifications, and create domain entries.
Risk Assessment
The organization is exposed to unauthorized actions in the certificate management system, including creation of rogue certificate authorities, which could lead to compromise of PKI infrastructure integrity and potential SSRF attacks.
Recommendation
It is recommended to upgrade Lemur to version 1.9.1 or later and explicitly set security flags to True to enforce strict role enforcement.
Original NVD description (English source)
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the .can() authorization gate permits every authenticated identity, including the read-only role. A read-only user can access POST /api/1/authorities, POST /api/1/certificates/upload, POST /api/1/pending_certificates//upload, POST /api/1/notifications, PUT or DELETE /api/1/notifications/, and POST /api/1/domains to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that reach an SSRF sink, and create domain entries. Explicitly setting either flag to False continues to opt into the permissive behavior. This issue is fixed in version 1.9.1.