An incorrect authorization flaw in Netflix Lemur permits authenticated attackers to bypass security checks and manipulate TLS certificate creation, risking infrastructure integrity.

The application is affected by CWE-863, Incorrect Authorization. An authenticated attacker (PR:L) can leverage this flaw to perform operations that should be restricted, impacting the security of managed TLS certificates.

Successful exploitation could allow an attacker to issue fraudulent certificates or modify existing certificate configurations. This compromises the trust model of the organization's PKI infrastructure, earning a CVSS score of 8.8 due to the high impact on confidentiality, integrity, and availability.

Immediate Action: Update the PyPI package lemur to version 1.9.1 or later immediately.

Proactive Monitoring: Review audit logs within Lemur for unauthorized certificate creation requests or unexpected changes to authorization roles.

Compensating Controls: Restrict access to the Lemur management interface to known, trusted management segments and enforce multi-factor authentication for all users.

Public Exploit Available: Unknown.

Due to the critical role Lemur plays in managing sensitive TLS certificates, this vulnerability should be remediated as a matter of urgency. Users must upgrade to version 1.9.1 to ensure that authorization controls are correctly enforced.