OpenWISP Controller contains an authorization flaw in its authenticated REST API endpoint for downloading CA Certificate Revocation Lists (CRLs). The endpoint does not properly scope requests to the managed organization, allowing an organization manager to access CRLs belonging to other organizations by enumerating CA IDs. The exposure is limited to CRL data, which includes CA issuer information and revoked certificate serial numbers, but does not include private keys or allow modification. The flaw affects versions from 1.0.0 up to but not including 1.3.2 and has been fixed in version 1.3.2.