CVE-2026-71417

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3

Description An issue exists where a non-read-only user can create a duplicate record via the 'POST /api/1/certificates/upload' endpoint by using another certificate body, authority id, serial, or external id without needing permission for the underlying authority. Subsequently, the 'PUT /api/1/certificates//revoke' endpoint only authorizes the caller against the selected record, allowing the creator of the duplicate to bypass CertificatePermission. Because the duplicate lacks cert.endpoints, it also bypasses safeguards preventing the revocation of deployed certificates. This allows issuer plugins to revoke the actual CA-side certificate using the certificate.body or external id via stored authority credentials, potentially leading to a fleet-wide TLS denial of service.

Recommendations Update to version 1.9.3.