Threats tagged 'ghsa-3rh3-f3vh-mgjh'

CVE-2026-95811 is an authorization bypass vulnerability in Lemonldap::NG::Handler for Perl. It affects versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, and from 2.22.0 before 2.23.4. The vulnerability arises because the handler matches locationRules regular expressions against the raw request URI, while the web server routes on a normalized and percent-decoded path. This mismatch allows an attacker to bypass locationRules restrictions by using equivalent path spellings with percent-encoding, dot segments, or double slashes. Only virtual hosts whose default rule is more permissive than other rules are affected, allowing authenticated users to access URLs that should be restricted by locationRules but only with the permissions of the default rule.