30 matches found
CVE-2026-116677
A flaw was found in openwisp-controller. An authorization bypass vulnerability in the certificate revocation list CRL download endpoint allows an authenticated user with Certificate Authority CA view permissions to retrieve CRL data belonging to other organizations by specifying their sequential ...
openwisp-controller
openwisp-controller .. image:: https://github.com/openwisp/openwisp-controller/actions/workflows/ci.yml/badge.svg :target: https://github.com/openwisp/openwisp-controller/actions/workflows/ci.yml :alt: CI build status .. image:: https://coveralls.io/repos/openwisp/openwisp-controller/badge.svg...
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
Summary The authenticated REST API endpoint for downloading a CA Certificate Revocation List resolves the requested CA without applying the organization-scoped queryset used by the rest of the PKI API. An organization manager with CA view permission can request another organization's sequential C...
EUVD-2026-111234
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations...
GHSA-9GH4-XW24-9XH5 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
Summary The authenticated REST API endpoint for downloading a CA Certificate Revocation List resolves the requested CA without applying the organization-scoped queryset used by the rest of the PKI API. An organization manager with CA view permission can request another organization's sequential C...
openwisp-firmware-upgrader (>=1.2.0, <=1.2.1), openwisp-monitoring (>=1.2.0, <=1.2.1) potentially affected by CVE-2026-116677 via openwisp-controller (1.2.3)
openwisp-controller PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on openwisp-controller and may be impacted: - openwisp-firmware-upgrader =1.2.0, =1.2.0, =1.2.1 Source cves: CVE-2026-116677 Source advisory: GHSA-9GH4-XW24-9XH5...
openwisp-firmware-upgrader (>=1.2.0, <=1.2.1), openwisp-monitoring (>=1.2.0, <=1.2.1) potentially affected by CVE-2026-116677 via openwisp-controller (1.2.3)
openwisp-controller PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on openwisp-controller and may be impacted: - openwisp-firmware-upgrader =1.2.0, =1.2.0, =1.2.1 Source cves: CVE-2026-116677 Source advisory: OSV:GHSA-9GH4-XW24-9XH5...
django-whiteneuron (>=0.2.48.2, <=0.3.1.2), faradaysec (>=4.1.0, <=4.4.1) +20 more potentially affected by CVE-2026-116579 via autobahn (26.7.1)
autobahn PYPI version 26.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - django-whiteneuron =0.2.48.2, =4.1.0, =3.11.3, =1.10.0, =1.0.0, =1.2.0, =1.2.0, =0.3.0b0, =4.0.1, =4.0.1, =4.0.1, =4.1.9 and more Source cves:...
CVE-2026-116677
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...
CVE-2026-116677 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...
CVE-2026-116677 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...
CVE-2026-116677
The OpenWISP Controller (versions 1.0.0 through 1.3.2 ) contains an authorization bypass in the GET /api/v1/controller/ca//crl endpoint. The vulnerability exists because CrlDownloadView.retrieve resolves the CA directly via a sequential identifier instead of using the organization-scoped retrieva...
CVE-2026-116677 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...
CVE-2026-116677
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...
CVE-2026-116677: Missing Authorization
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/ /crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization'...
OpenWisp Controller authorization issue vulnerability
OpenWisp Controller versions from 1.0.0 up to but including version 1.3.2 contain an authorization issue vulnerability. This vulnerability stems from improper authorization checks; authenticated organization administrators can request certificate revocation lists from other organizations via...
PT-2026-126706
Name of the Vulnerable Software and Affected Versions OpenWISP Controller versions 1.0.0 through 1.3.1 Description An authenticated organization manager with CA view permission can retrieve the certificate revocation list of another organization. This occurs because the CrlDownloadView.retrieve...
arthexis (>=0.1.3, <=0.11.0), ayugespidertools (>=3.13.4, <=3.14.1) +24 more potentially affected by CVE-2026-106454 via twisted (25.5.0)
twisted PYPI version 25.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - arthexis =0.1.3, =3.13.4, =1.4.0, =2.11.0, =2.7.0, =2.4.0, =1.0.7, =1.10.0, =0.28.0, =1.0.0, =1.57.0, =1.57.1 and more Source cves: CVE-2026-1064...
congo-lab (>=0.7.1, <=0.8.0), ezbeq (>=1.0.0b17, <=2.2.1) +8 more potentially affected by CVE-2026-77528 via autobahn (23.6.2)
autobahn PYPI version 23.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - congo-lab =0.7.1, =1.0.0b17, =0.2.0, =7.0.0, =1.2.4, =1.0.0, =3.0.0 - yangsuite-devices 2.8.7 Source cves: CVE-2026-77528 Source advisory:...
openwisp-controller v1.3.0
openwisp-controller .. image:: https://github.com/openwisp/openwisp-controller/actions/workflows/ci.yml/badge.svg :target: https://github.com/openwisp/openwisp-controller/actions/workflows/ci.yml :alt: CI build status .. image:: https://coveralls.io/repos/openwisp/openwisp-controller/badge.svg...