CVE-2026-116677 with a CVSS score of 5.3 is a missing authorization flaw in the OpenWISP Controller CA CRL REST API. The authenticated endpoint for downloading a CA Certificate Revocation List (CRL) by integer ID resolves the requested CA without applying the organization-scoped queryset used by the rest of the PKI API. An organization manager with CA view permission can enumerate sequential CA identifiers and request a CA belonging to another organization, causing the endpoint to return that organization's CRL. The flaw bypasses the intended access-control path and object-level permission checks, even though the sibling CA detail endpoint correctly enforces organization-level access controls. The disclosed CRL includes CA issuer information and revoked certificate serial numbers but does not expose CA private keys or permit modification. Since django-x509 exposes CRLs publicly by default unless protection is explicitly enabled, default deployments do not introduce a new confidentiality exposure. However, deployments with protected CRLs may experience unauthorized disclosure, undermining the intended organization-level API authorization boundary.
We recommend you to update openwisp-controller to version 1.3.2 or later.[/subscribe_to_unlock_form]
CVE-2026-116677 with a CVSS score of 5.3 is a missing authorization flaw in the OpenWISP Controller CA CRL REST API. The authenticated endpoint for downloading a CA Certificate Revocation List (CRL) by integer ID resolves the requested CA without applying the organization-scoped queryset used by the rest of the PKI API. An organization manager with CA view permission can enumerate sequential CA identifiers and request a CA belonging to another organization, causing the endpoint to return that organization's CRL. The flaw bypasses the intended access-control path and object-level permission checks, even though the sibling CA detail endpoint correctly enforces organization-level access controls. The disclosed CRL includes CA issuer information and revoked certificate serial numbers but does not expose CA private keys or permit modification. Since django-x509 exposes CRLs publicly by default unless protection is explicitly enabled, default deployments do not introduce a new confidentiality exposure. However, deployments with protected CRLs may experience unauthorized disclosure, undermining the intended organization-level API authorization boundary.
We recommend you to update openwisp-controller to version 1.3.2 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]