THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-48508 (HIGH 8.8) — Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unse

[NVD] CVE-2026-48508 (HIGH 8.8) — Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.init() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unse

mednvdPublished 2026-08-18

CVE-2026-48508 CVSS: 8.8 HIGH Published: 2026-08-18T18:17:41.073

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal

Indicators of compromise

CVE-2026-48508cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-48508