Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission
Date: 2026-06
Affected: pip/lemur
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-48508
CWE: CWE-863
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

## Summary `StrictRolePermission` and `AuthorityCreatorPermission` in `lemur/auth/permissions.py` call `flask_principal.Permission.__init__()` with zero `Need`s when their config flags are unset. Both flags defaulted to `False` in code prior to the fix, so this was the state of any Lemur install that hadn't explicitly opted in. Flask-Principal's `Permission.allows()` returns `True` whenever `self.needs` is empty. The `.can()` gate therefore passes for every authenticated identity, including the lowest-privilege role Lemur ships (`read-only`). A user holding only `read-only` can create root Certificate Authorities, create and edit notifications (an SSRF sink), create domain entries, and upload arbitrary certificates. These classes are the sole authorization check on those endpoints. ## Root Cause ```python # lemur/auth/permissions.py class AuthorityCreatorPermission(Permission): def __init__(self): requires_admin = current_app.config.get("ADMIN_ONLY_AUTHORITY_CREATION", False) if requires_admin: super().__init__(RoleNeed("admin")) else: super().__init__() # empty Need set class StrictRolePermission(Permission): def __init__(self): strict_role_enforcement = current_app.config.get("LEMUR_STRICT_ROLE_ENFORCEMENT", False) if strict_role_enforcement: needs = [RoleNeed("admin"), RoleNeed("operator")] super().__init__(*needs) else: super().__init__()


Mitigations:

Architectural layers (MAESTRO):