A GET endpoint that retrieves the certificate revocation list for a CA identifies CA objects solely by their numeric ID, ignoring the organization boundary that should be enforced. An authenticated manager with view permissions can use this flaw to pull the CRL of any other organization, exposing the issuer chain and revoked serial numbers. The disclosure does not provide private keys or modify data, but it leaks information that could assist attackers in mapping network trust relationships or identifying revoked certificates in use.

The vulnerability affects OpenWISP Controller versions 1.0.0 through 1.3.2. Any deployment of this release that exposes the REST endpoint /api/v1/controller/ca/<id>/crl to organization managers is susceptible. The flaw is specific to the CA management component of the controller and does not involve other modules.

The CVSS score of 5.3 indicates moderate severity, focusing on confidentiality impact. An exploiter must possess valid credentials for a manager role with CA view access, which limits the attack surface to authenticated users. The EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread off‑the‑shack exploitation is not yet observed. However, within an organization the flaw permits non‑consensual disclosure of trust data to other managers, which can be leveraged in subsequent attacks.