CVE-2026-48508: CWE-863: Incorrect Authorization in Netflix lemur
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the .can() authorization gate permits every authenticated identity, including the read-only role. A read-only user can access POST /api/1/authorities, POST /api/1/certificates/upload, POST /api/1/pending_certificates//upload, POST /api/1/notifications, PUT or DELETE /api/1/notifications/, and POST /api/1/domains to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that reach an SSRF sink, and create domain entries. Explicitly setting either flag to False continues to opt into the permissive behavior. This issue is fixed in version 1.9.1.
AI Analysis
Technical Summary
Lemur, a TLS certificate management tool by Netflix, has an authorization flaw (CWE-863) in versions before 1.9.1. The flaw arises because StrictRolePermission and AuthorityCreatorPermission call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT flags are unset (defaulting to False). Flask-Principal's Permission.allows() returns True if no needs are specified, allowing any authenticated user, including those with read-only roles, to bypass authorization checks. This enables unauthorized users to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that could lead to SSRF, and create domain entries. The vulnerability is resolved in Lemur version 1.9.1.
Potential Impact
Unauthorized users with read-only roles can perform privileged operations such as creating root Certificate Authorities, uploading arbitrary certificates, modifying notifications that may lead to SSRF vulnerabilities, and creating domain entries. This can lead to full compromise of TLS certificate management, impacting confidentiality, integrity, and availability of the system.
Mitigation Recommendations
Upgrade Lemur to version 1.9.1 or later, where this authorization issue is fixed. Explicitly setting ADMIN_ONLY_AUTHORITY_CREATION or LEMUR_STRICT_ROLE_ENFORCEMENT to True also mitigates the permissive authorization behavior. Patch status is not explicitly stated but the fix is available in version 1.9.1.
CVE-2026-48508: CWE-863: Incorrect Authorization in Netflix lemur
Description
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the .can() authorization gate permits every authenticated identity, including the read-only role. A read-only user can access POST /api/1/authorities, POST /api/1/certificates/upload, POST /api/1/pending_certificates//upload, POST /api/1/notifications, PUT or DELETE /api/1/notifications/, and POST /api/1/domains to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that reach an SSRF sink, and create domain entries. Explicitly setting either flag to False continues to opt into the permissive behavior. This issue is fixed in version 1.9.1.
CVSS v3.1
Score 8.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Lemur, a TLS certificate management tool by Netflix, has an authorization flaw (CWE-863) in versions before 1.9.1. The flaw arises because StrictRolePermission and AuthorityCreatorPermission call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT flags are unset (defaulting to False). Flask-Principal's Permission.allows() returns True if no needs are specified, allowing any authenticated user, including those with read-only roles, to bypass authorization checks. This enables unauthorized users to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that could lead to SSRF, and create domain entries. The vulnerability is resolved in Lemur version 1.9.1.
Potential Impact
Unauthorized users with read-only roles can perform privileged operations such as creating root Certificate Authorities, uploading arbitrary certificates, modifying notifications that may lead to SSRF vulnerabilities, and creating domain entries. This can lead to full compromise of TLS certificate management, impacting confidentiality, integrity, and availability of the system.
Mitigation Recommendations
Upgrade Lemur to version 1.9.1 or later, where this authorization issue is fixed. Explicitly setting ADMIN_ONLY_AUTHORITY_CREATION or LEMUR_STRICT_ROLE_ENFORCEMENT to True also mitigates the permissive authorization behavior. Patch status is not explicitly stated but the fix is available in version 1.9.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-21T16:18:10.618Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a84a24cc6e8be033294f6ad
Added to database: 08/18/2026, 18:19:56 UTC
Last enriched: 08/18/2026, 18:34:19 UTC
Last updated: 08/18/2026, 19:50:11 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.