CVE-2026-116677

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

CVE-2026-116677

The OpenWISP Controller (versions 1.0.0 through 1.3.2 ) contains an authorization bypass in the GET /api/v1/controller/ca//crl endpoint. The vulnerability exists because CrlDownloadView.retrieve resolves the CA directly via a sequential identifier instead of using the organization-scoped retrieva...

CVE-2026-116677 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

EUVD-2026-111234

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

openwisp-controller

openwisp-controller .. image:: https://github.com/openwisp/openwisp-controller/actions/workflows/ci.yml/badge.svg :target: https://github.com/openwisp/openwisp-controller/actions/workflows/ci.yml :alt: CI build status .. image:: https://coveralls.io/repos/openwisp/openwisp-controller/badge.svg...

PT-2026-126706

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

arthexis (>=0.1.3, <=0.11.0), ayugespidertools (>=3.13.4, <=3.14.1) +24 more potentially affected by CVE-2026-106454 via twisted (25.5.0)

twisted PYPI version 25.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - arthexis =0.1.3, =3.13.4, =1.4.0, =2.11.0, =2.7.0, =2.4.0, =1.0.7, =1.10.0, =0.28.0, =1.0.0, =1.57.0, =1.57.1 and more Source cves: CVE-2026-1064...

congo-lab (>=0.7.1, <=0.8.0), ezbeq (>=1.0.0b17, <=2.2.1) +8 more potentially affected by CVE-2026-77528 via autobahn (23.6.2)

autobahn PYPI version 23.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - congo-lab =0.7.1, =1.0.0b17, =0.2.0, =7.0.0, =1.2.4, =1.0.0, =3.0.0 - yangsuite-devices 2.8.7 Source cves: CVE-2026-77528 Source advisory:...

openwisp-controller v1.3.0

openwisp-controller .. image:: https://github.com/openwisp/openwisp-controller/actions/workflows/ci.yml/badge.svg :target: https://github.com/openwisp/openwisp-controller/actions/workflows/ci.yml :alt: CI build status .. image:: https://coveralls.io/repos/openwisp/openwisp-controller/badge.svg...

openwisp-controller (>=1.0.0, <=1.1.2) potentially affected by unknown CVE via openwisp-ipam (>=1.0.0, <=1.1.1)

openwisp-ipam PYPI version =1.0.0, =1.0.0, =1.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-X287-5C68-36WP...

openwisp-controller (>=1.0.0, <=1.1.2) potentially affected by unknown CVE via openwisp-ipam (>=1.0.0, <=1.1.1)

openwisp-ipam PYPI version =1.0.0, =1.0.0, =1.1.2 Source cves: unknown CVE Source advisory: GHSA-X287-5C68-36WP...

openwisp-controller (>=1.0.0, <=1.1.2) potentially affected by unknown CVE via openwisp-ipam (>=1.0.0, <=1.1.1)

openwisp-ipam PYPI version =1.0.0, =1.0.0, =1.1.2 Source cves: unknown CVE Source advisory: SNYK:PYTHON-OPENWISPIPAM-19427353...

ducktape (>=0.9.0, <=0.12.0), openwisp-controller (>=1.0.0, <=1.0.3) +2 more potentially affected by CVE-2026-44405 via paramiko (2.10.6)

paramiko PYPI version 2.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - ducktape =0.9.0, =1.0.0, =0.1.0, =1.29.14, =1.29.15 Source cves: CVE-2026-44405 Source advisory: OSV:PYSEC-2026-2858...

ducktape (>=0.9.0, <=0.12.0), openwisp-controller (>=1.0.0, <=1.0.3) +2 more potentially affected by CVE-2026-44405 via paramiko (2.10.6)

paramiko PYPI version 2.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - ducktape =0.9.0, =1.0.0, =0.1.0, =1.29.14, =1.29.15 Source cves: CVE-2026-44405 Source advisory: OSV:GHSA-R374-RXX8-8654...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2026-27982 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V67...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2026-27982 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2026-27982 Source advisory: OSV:PYSEC-2026-56...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65430 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65430 Source advisory: OSV:GHSA-QHMC-3MVR-F2J...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65431 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65431 Source advisory: OSV:GHSA-8M3C-C723-H4P...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65431 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65431 Source advisory: OSV:PYSEC-2025-111...