Netflix Lemur versions before 1.9.3 contain a missing authorization vulnerability (CWE-862) where GET /api/1/destinations and GET /api/1/destinations/ endpoints only required authentication but not administrator permissions. These endpoints returned raw options including sensitive data such as passwords and private key passphrases stored in plaintext by the sftp-destination plugin. This exposure allows users with read-only privileges to retrieve credentials that could be used to access remote certificate deployment hosts and TLS materials outside Lemur's security boundary. The vulnerability is resolved in version 1.9.3 by requiring administrator permissions for destination reads and redacting sensitive fields.

An attacker with read-only access to Lemur prior to version 1.9.3 can retrieve plaintext credentials for SFTP destinations, potentially enabling unauthorized access to remote systems and TLS certificate materials. This compromises confidentiality but does not affect integrity or availability directly. The CVSS 3.1 base score is 7.7 (high), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

Upgrade Lemur to version 1.9.3 or later, where this vulnerability is fixed by enforcing administrator permissions on destination read endpoints and redacting sensitive options. No other mitigation is indicated or required by the vendor advisory. Patch status is confirmed fixed in 1.9.3.