CVE-2026-71317

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3

Description An issue exists in the TLS certificate creation process where the endpoint "/api/1/authorities" does not properly verify permissions when the type parameter is set to subca and ADMIN ONLY AUTHORITY CREATION is false. The AssociatedAuthoritySchema resolves the parent authority provided by the caller and passes it to the cryptography-issuer, which uses the authority certificate.private key of the parent to sign a new intermediate certificate. This allows any authenticated non-read-only user to chain a sub-CA to an internal root without having the required role, enabling the issuance of trusted certificates and the use of the private key outside the system to bypass issuance controls.

Recommendations Update to version 1.9.3.