CVE-2026-48508

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.1

Description An authorization bypass exists in StrictRolePermission and AuthorityCreatorPermission within lemur/auth/permissions.py. When the configuration flags ADMIN ONLY AUTHORITY CREATION and LEMUR STRICT ROLE ENFORCEMENT are unset, they default to False, causing the flask principal.Permission. init () function to be called with no Need objects. Because the Permission.allows() function returns True when the needs set is empty, the .can() authorization gate permits any authenticated identity, including users with the read-only role.

This allows a low-privilege user to perform administrative actions via the following API endpoints:

Exploitation enables the creation of root Certificate Authorities, uploading of arbitrary certificates, creation of domain entries, and the creation or modification of notifications that reach an SSRF (Server-Side Request Forgery) sink—a vulnerability where an attacker can force the server to make requests to an unintended location.

Recommendations Update Lemur to version 1.9.1 or later. Ensure that the configuration flags ADMIN ONLY AUTHORITY CREATION and LEMUR STRICT ROLE ENFORCEMENT are either left unset or explicitly set to True.