Threats affecting pkg:pypi/openwisp-controller

OpenWISP Controller versions from 1.0.0 up to but not including 1.3.2 contain an authorization bypass vulnerability in the GET /api/v1/controller/ca/<integer-id>/crl endpoint. An authenticated organization manager with CA view permission can access certificate revocation lists (CRLs) belonging to other organizations by exploiting improper authorization checks. The vulnerability exposes CA issuer information and revoked certificate serial numbers but does not disclose private keys or allow data modification. This issue is resolved in version 1.3.2.