{"id":"CVE-2026-74877","aliases":["GHSA-hvc7-763r-4f3h"],"title":"openssl-encrypt has no owner verification on key revocation — any client can revoke any key","summary":"openssl-encrypt has no owner verification on key revocation — any client can revoke any key","severity":"medium","vendor":"openssl-encrypt","product":"openssl-encrypt","ecosystem":"pip","affected":["openssl-encrypt < 1.4.0"],"patched":["openssl-encrypt 1.4.0"],"published":"2026-04-01","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hvc7-763r-4f3h","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-hvc7-763r-4f3h"},{"url":"https://github.com/jahlives/openssl_encrypt/commit/05e45f393886b5bf7e924d2dd42099a9dd37f91d"},{"url":"https://github.com/jahlives/openssl_encrypt"}],"tags":["osv","pip"],"ingestedAt":"2026-08-18T12:28:09.042Z","epss":0.00248,"epssPercentile":0.16404,"slug":"CVE-2026-74877","body":"## Overview\n\n### Summary\n\nThe `revoke_key` method in `openssl_encrypt_server/modules/keyserver/service.py` at **lines 195-270** accepts a `client_id` parameter but never verifies that the requesting client is the same as `key.owner_client_id`.\n\n### Impact\n\nAny authenticated client can revoke any other client's key, as long as they provide a valid revocation signature. While the signature requirement mitigates this somewhat (you need the private key to sign), the lack of ownership check is a defense-in-depth gap.\n\n### Recommended Fix\n\n- Add an ownership check: verify `client_id == key.owner_client_id` before allowing revocation\n- Return 403 Forbidden if the requesting client does not own the key\n\n### Fix\n\nFixed in commit `05e45f3` on branch `releases/1.4.x` — added documentation that ML-DSA signature verification IS the cryptographic ownership check; added info-level logging on successful verification.\n\n## Affected packages\n\n- `openssl-encrypt < 1.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `openssl-encrypt 1.4.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}