Lemonldap::NG::Handler versions 2.0.0 before 2.16.10, 2.17.0 before 2.21.6, and 2.22.0 before 2.23.4 for Perl contain an incorrect authorization vulnerability (CWE-863). The handler matches each virtual host's locationRules regex against the raw REQUEST_URI, while the web server routes on a percent-decoded and normalized path. This mismatch allows an attacker to bypass locationRules restrictions by crafting requests with percent-encoded characters, dot segments, or double slashes, causing the request to be routed under a URI that does not match any locationRules regex. Consequently, the virtual host's default rule applies, which may be more permissive. This bypass affects only virtual hosts whose default rule is less restrictive than other locationRules. The attacker must be authenticated and gains access only to what the default rule permits, not beyond that.

An authenticated user can bypass locationRules restrictions intended to limit access to certain URLs by exploiting the difference in URI normalization between the handler and the web server. This allows access to URLs that should be restricted by locationRules regexes but are accessible under the default rule. The impact is limited to the permissions granted by the default rule of the affected virtual host. There is no indication of privilege escalation beyond the default rule's permissions or unauthenticated access.

No explicit patch or remediation is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review virtual host configurations to ensure that default rules are not more permissive than locationRules restrictions, minimizing the risk of unauthorized access via this bypass.