CVE-2026-71317 is a missing authorization vulnerability (CWE-862) in Netflix Lemur's TLS certificate management system. Before version 1.9.3, the POST /api/1/authorities endpoint with type=subca did not enforce AuthorityPermission checks on the parent authority when the ADMIN_ONLY_AUTHORITY_CREATION setting was false. This allowed any authenticated user with non-read-only privileges to create a subordinate CA chained to an internal root authority for which they had no role. The parent authority's private key was used to sign the new intermediate certificate, enabling issuance of trusted certificates and use of the private key outside Lemur, bypassing normal issuance controls. The vulnerability was addressed by adding AuthorityPermission checks on every supplied parent authority before invoking the issuer in version 1.9.3.

An authenticated user with non-read-only access could create subordinate CAs chained to internal root authorities without proper authorization. This could lead to issuance of trusted certificates by unauthorized parties and potential misuse of private keys outside Lemur, compromising the trust model and certificate issuance controls.

Upgrade to Netflix Lemur version 1.9.3 or later, where AuthorityPermission checks are enforced on all parent authorities during sub-CA creation. This fix prevents unauthorized users from chaining sub-CAs to internal roots and bypassing issuance controls.