CVE-2026-116677
Description
A flaw was found in openwisp-controller. An authorization bypass vulnerability in the certificate revocation list (CRL) download endpoint allows an authenticated user with Certificate Authority (CA) view permissions to retrieve CRL data belonging to other organizations by specifying their sequential CA identifiers. This issue results in cross-tenant information disclosure, exposing CA issuer details and revoked certificate serial numbers.
Statement
This vulnerability is rated with a Moderate severity impact because an attacker must already possess valid credentials with CA viewing privileges, and exploitation discloses only certificate revocation lists rather than compromising private cryptographic keys or permitting data modification. In addition, openwisp-controller is not packaged or distributed in any supported Red Hat product offerings, resulting in no direct exposure for Red Hat enterprise environments.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
