Lemur versions 0.5.0 through 1.9.2 accept replacement certificate identifiers in create, upload, and edit requests without verifying permissions on those certificates. This lack of authorization checks allows an authenticated user with non-read-only privileges to assign replacement certificates they do not own, triggering an append listener that disables notifications and marks the victim certificate as replaced. Consequently, the victim certificate is excluded from pending reissue processes, allowing the attacker’s certificate to be deployed to endpoints serving the victim. The vulnerability is addressed in Lemur 1.9.3 by enforcing authorization checks on every referenced replacement certificate before mutation.

An attacker with authenticated non-read-only access can bypass authorization controls to suppress certificate lifecycle automation and substitute certificates they do not own. This can cause widespread TLS disruption across the fleet and unauthorized certificate deployment, impacting service integrity and availability. Confidentiality is not directly impacted, but integrity and availability are severely affected.

Upgrade Lemur to version 1.9.3 or later, where authorization checks on replacement certificates are enforced before mutation. Since this is an on-premises product, apply the official fix promptly to prevent exploitation. Patch status is confirmed fixed in version 1.9.3.