---
id: CVE-2026-48508
title: Lemur manages TLS certificate creation
summary: >-
  Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission
  and AuthorityCreatorPermission in lemur/auth/permissions.py call
  flask_principal.Permission.__init__() with zero Need objects when
  ADMIN_ONLY_AUTHORITY_CREATION…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
vendor: lemur
product: lemur
affected:
  - lemur <= 1.9.0
patched:
  - lemur 1.9.1
published: '2026-08-18'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:45.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48508'
references:
  - url: >-
      https://github.com/Netflix/lemur/commit/e6a41e2c1b2028840d19039b06895524a19ad36f
    label: security-advisories@github.com
  - url: 'https://github.com/Netflix/lemur/releases/tag/v1.9.1'
    label: security-advisories@github.com
  - url: 'https://github.com/Netflix/lemur/security/advisories/GHSA-qcqw-jwxc-2hqg'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qcqw-jwxc-2hqg'
tags:
  - nvd
  - ghsa
  - pip
epss: 0.00236
epssPercentile: 0.14893
ecosystem: pip
ingestedAt: '2026-06-26T16:43:14.230Z'
---

## Overview

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the .can() authorization gate permits every authenticated identity, including the read-only role. A read-only user can access POST /api/1/authorities, POST /api/1/certificates/upload, POST /api/1/pending_certificates//upload, POST /api/1/notifications, PUT or DELETE /api/1/notifications/, and POST /api/1/domains to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that reach an SSRF sink, and create domain entries. Explicitly setting either flag to False continues to opt into the permissive behavior. This issue is fixed in version 1.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-48508)

Affected packages:

- `lemur <= 1.9.0`

Patched in:

- `lemur 1.9.1`

Source: https://github.com/advisories/GHSA-qcqw-jwxc-2hqg