A flaw in Dogtag PKI’s ACME responder allows an unauthenticated attacker to append a trailing slash to the admin-only "/enable" or "/disable" endpoints, bypassing Tomcat’s authentication constraint while RESTEasy still forwards the request to the handler. This bypass, classified as an authorization flaw (CWE‑288), lets an attacker toggle the ACME service state without authorization, causing a denial of service that remains persistent until the service is re-enabled. The vulnerability stems from the web.xml security constraints using exact URL pattern matching for these endpoints.

The issue affects Red Hat Certificate System versions 9, 10, and 11, as well as Red Hat Enterprise Linux releases 6 through 10, which host the Dogtag PKI components containing the ACME responder. Administrators deploying any of these products should verify if the ACME responder is enabled.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is less than 1%, implying a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote; an unauthenticated user can issue an HTTP request to the affected endpoint with a trailing slash and immediately influence the ACME service state. No additional credentials or privileged context are required, making exploitation relatively straightforward once the endpoint is reachable.