Lemur, a TLS certificate management tool by Netflix, had a missing authorization check in the POST /api/1/authorities endpoint when creating sub-CAs with type=subca. When the ADMIN_ONLY_AUTHORITY_CREATION setting was false, the system did not require AuthorityPermission on the parent authority. This allowed authenticated users with limited privileges to create a sub-CA chained to an internal root authority for which they had no role. The sub-CA's private key could then be used to issue trusted certificates and be used outside Lemur, bypassing normal issuance controls. The vulnerability is resolved by enforcing AuthorityPermission checks on every supplied parent authority before invoking the issuer, starting with Lemur version 1.9.3.

An authenticated user with non-read-only privileges could create a subordinate CA linked to an internal root without proper authorization. This sub-CA could issue trusted certificates, potentially allowing unauthorized certificate issuance and misuse of private keys outside the normal issuance controls. This could undermine the trust model of TLS certificates managed by Lemur.

Upgrade Lemur to version 1.9.3 or later, where AuthorityPermission checks are enforced on all parent authorities during sub-CA creation. No other mitigations are specified. Patch status is not explicitly stated as 'official-fix' but the fix is included in version 1.9.3.