CVE-2026-77639: Unprotected Alternate Channel

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

PYSEC-2026-3677 Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Summary Repo under test: https://github.com/Netflix/lemur When ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field...

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

SummaryRepo under test: https://github.com/Netflix/lemurWhen ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field i...

CVE-2026-70408

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

CVE-2026-70408

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

CVE-2026-70408

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

CVE-2026-70408

acmailer has an incorrect authorization flaw allowing low-privilege users to create sub-accounts with full administrative privileges (CVSS 8.8 HIGH, network-accessible). JPCERT/CC advisory JVN47716829 and vendor notice are referenced; no exploit or patch details are provided in the documents. Mon...

EUVD-2026-62238

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

PT-2026-78269

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

CVE-2026-70408: Incorrect Authorization

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

GHSA-G7P5-89MH-248H Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Summary Repo under test: https://github.com/Netflix/lemur When ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field...

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Summary Repo under test: https://github.com/Netflix/lemur When ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field...

CVE-2026-71317

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMINONLYAUTHORITYCREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority...

CVE-2026-71317 Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMINONLYAUTHORITYCREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority...

CVE-2026-71317 Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMINONLYAUTHORITYCREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority...

CVE-2026-71317 Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMINONLYAUTHORITYCREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority...

EUVD-2026-61156

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMINONLYAUTHORITYCREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority...

CVE-2026-71317

Netflix Lemur before 1.9.3 allowed any authenticated non-read-only user to create a sub-CA chained to an internal root they lacked permission for, since AuthorityPermission was never checked on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. The resulting intermediate's private...

PT-2026-77284

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3 Description An issue exists in the TLS certificate creation process where the endpoint "/api/1/authorities" does not properly verify permissions when the type parameter is set to subca and ADMIN ONLY AUTHORITY...

EUVD-2026-58817

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...