CVE-2026-116677

Name of the Vulnerable Software and Affected Versions OpenWISP Controller versions 1.0.0 through 1.3.1

Description An authenticated organization manager with CA view permission can retrieve the certificate revocation list of another organization. This occurs because the CrlDownloadView.retrieve function resolves the CA directly, bypassing the organization-scoped object retrieval enforced by FilterByOrganizationManaged. An attacker can exploit this by requesting a sequential CA identifier via the '/api/v1/controller/ca//crl' endpoint. This may disclose CA issuer information and revoked certificate serial numbers.

Recommendations Update to version 1.3.2.