Lemur, a TLS certificate management tool by Netflix, had an authorization bypass vulnerability (CWE-639) in versions before 1.9.3. The POST /api/1/certificates/upload endpoint allowed a non-read-only user to create duplicate certificate rows using another certificate's body, authority_id, serial, or external_id without requiring permission on the underlying authority. The PUT /api/1/certificates//revoke endpoint authorized revocation only against the selected Lemur row, so the creator of the duplicate bypassed CertificatePermission checks. Because the duplicate certificate had no endpoints, it bypassed safeguards preventing revocation of deployed certificates. Consequently, issuer plugins revoked the real CA-side certificate using stored authority credentials, enabling an attacker to revoke arbitrary managed certificates and cause fleet-wide TLS denial of service. The vulnerability is fixed in version 1.9.3 by rejecting duplicate authority_id and serial identities, requiring authority access on upload, and checking all matching rows during revocation.

An attacker with non-read-only user privileges can bypass authorization controls to revoke arbitrary managed TLS certificates, potentially causing a denial of service across the entire certificate fleet managed by Lemur. This impacts the availability of TLS services relying on these certificates but does not affect confidentiality or integrity directly.

Upgrade Lemur to version 1.9.3 or later, which includes fixes that reject duplicate authority_id and serial identities, enforce authority access on certificate upload, and verify all matching rows during revocation. No other mitigations are specified or required.