CVE-2026-71322

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3

Description An issue exists in the CertificateExport process where the ownership check for CertificatePermission was incorrectly placed within the plugin.requires key branch for the 'POST /api/1/certificates//export' endpoint. When a plugin declared requires key as false, the ownership check was bypassed. Despite this, the handler continued to pass the cert.private key variable as an argument and recorded a key view audit event. While the bundled JavaTruststoreExportPlugin ignored the key, limiting immediate exposure to public certificate material and inaccurate audit logs, other plugins could potentially consume the supplied private key.

Recommendations Update to version 1.9.3.