StrictRolePermission and AuthorityCreatorPermission are instantiated with no Need objects when two configuration flags are unset, meaning that authorization checks automatically allow any authenticated identity. A user with a read‑only role can therefore hit privileged API endpoints—creating root certificate authorities, uploading arbitrary certificates, editing notifications and domains—and can also trigger SSRF attacks against internal resources. The flaw is a classic example of authorization bypass, which can expose confidentiality through forged certificates, integrity via unauthorized configuration changes, and availability if the system is misused to flood or redirect traffic.

All releases of Netflix's Lemur before version 1 . 9 . 1 contain this flaw. The affected components are housed in lemur/auth/permissions.py and expose the bug through the public REST API endpoints listed in the advisory. Upgrading to v1.9.1 or later resolves the issue; no other vendor or version is affected.

The CVSS score of 8.8 reflects a high severity, and while an EPSS score is not disclosed, the vulnerability is not in the KEV catalogue, suggesting no widely known public exploits yet. Attackers need only an authenticated session with a read‑only role, making the exploit trivial over the network. The remote nature of the API and the lack of additional authentication steps lower the barrier to exploitation.