CVE-2026-48508

Lemur (Netflix's TLS certificate management service) prior to 1.9.1 contains an authorization bypass in StrictRolePermission and AuthorityCreatorPermission (lemur/auth/permissions.py). When ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset (both default to False), flask_pr...

CVE-2026-48508 Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...