CVE-2026-48508
Received Received - Intake

Improper Authorization in Lemur Prior to 1.9.1

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the .can() authorization gate permits every authenticated identity, including the read-only role. A read-only user can access POST /api/1/authorities, POST /api/1/certificates/upload, POST /api/1/pending_certificates//upload, POST /api/1/notifications, PUT or DELETE /api/1/notifications/, and POST /api/1/domains to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that reach an SSRF sink, and create domain entries. Explicitly setting either flag to False continues to opt into the permissive behavior. This issue is fixed in version 1.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-48508
EUVD
EUVD-2026-61100

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lemur lemur 1.9.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48508 is an authorization bypass vulnerability in Netflix's Lemur project. It occurs when StrictRolePermission and AuthorityCreatorPermission initialize with empty permission requirements due to unset configuration flags. This allows any authenticated user, including read-only roles, to perform high-privilege actions like creating root Certificate Authorities or uploading arbitrary certificates.

Detection Guidance

To detect this vulnerability, check if your Lemur instance is running a version prior to 1.9.1. Run: lemur --version. Also review configuration files for ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT flags set to False. Inspect logs for unauthorized POST requests to /api/1/authorities, /api/1/certificates/upload, or similar endpoints by non-admin users.

Impact Analysis

An attacker with read-only access could exploit this to create unauthorized Certificate Authorities, upload malicious certificates, modify notifications (potential SSRF attacks), or manipulate domain entries. This could lead to data breaches, service disruption, or further network compromise.

Compliance Impact

This vulnerability could violate compliance requirements for data protection (GDPR), healthcare data security (HIPAA), and other standards by enabling unauthorized access to sensitive systems and data. Unauthorized certificate creation or certificate uploads could compromise encryption integrity.

Mitigation Strategies

Upgrade Lemur to version 1.9.1 or later. Ensure ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are set to True in configuration. If you must keep these flags False, implement strict access controls and monitor for unauthorized actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart