CVE-2026-71417

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

PT-2026-77286

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3 Description An issue exists where a non-read-only user can create a duplicate record via the 'POST /api/1/certificates/upload' endpoint by using another certificate body, authority id, serial, or external id witho...