# CVE-2026-48508: Netflix Lemur authorization bypass in permission classes

Source: https://junglewise.ai/threats/cve-2026-48508-netflix-lemur-authorization-bypass-in-permission-classes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48508 · Severity: high · CVSS 8.8 · Published 2026-06-25

Netflix Lemur, a certificate management framework, contains a flaw where certain security checks were disabled by default. This allows any logged-in user, even those with "read-only" access, to perform administrative actions such as creating root Certificate Authorities, uploading certificates, and modifying system notifications. An attacker could use this to issue fraudulent certificates or gain control over the organization's digital trust infrastructure.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-48508 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48508 being exploited in the wild.

**How severe is CVE-2026-48508?** High severity, with a CVSS score of 8.8, published 25 June 2026.

**Which products and versions are affected?** lemur (PyPI) <= 1.9.0, ECOSYSTEM:introduced=0,fixed=1.9.1.

**Is there a fix for CVE-2026-48508?** Yes. lemur (PyPI): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48508 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48508?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.1 or later

  ```sh
  pip install "lemur>=1.9.1"
  ```


## Technical details

An authorization bypass exists in Lemur's 'StrictRolePermission' and 'AuthorityCreatorPermission' classes within 'lemur/auth/permissions.py'. These classes utilize Flask-Principal for access control; however, when specific configuration flags (ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT) are unset or False, the permission objects are initialized with an empty set of 'Needs'. Because Flask-Principal's 'Permission.allows()' returns True for empty requirement sets, any authenticated user—including those with the 'read-only' role—can bypass authorization gates on critical API endpoints. This allows unauthorized creation of root CAs, certificate uploads, and modification of notification settings (which can lead to SSRF). The vulnerability is remediated in version 1.9.1 by changing the default value of these configuration flags to True.

## Affected products

- Netflix Lemur <= 1.9.0

## Identifiers

- CVE-2026-48508
- GHSA-qcqw-jwxc-2hqg
- PYSEC-2026-2588

## Timeline

- 2026-05-28: disclosed: Vulnerability reported to vendor
- 2026-06-25: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/hits313](https://api.github.com/users/hits313)
- [https://github.com/hits313](https://github.com/hits313)
- [https://api.github.com/users/hits313/gists%7B/gist_id%7D](https://api.github.com/users/hits313/gists%7B/gist_id%7D)
- [https://api.github.com/users/hits313/repos](https://api.github.com/users/hits313/repos)
- [https://avatars.githubusercontent.com/u/124338722?v=4](https://avatars.githubusercontent.com/u/124338722?v=4)
- [https://api.github.com/users/hits313/events%7B/privacy%7D](https://api.github.com/users/hits313/events%7B/privacy%7D)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)