A flaw in the Lemur destination API allowed users with only read‑only permissions to retrieve full configuration objects that included plaintext passwords and private‑key passphrases for the sftp‑destination plugin. These credentials provide direct access to remote certificate‑deployment hosts and the TLS material stored there. The vulnerability is an authorization bypass that exposes sensitive information without requiring additional privileges.

The issue affects installations of Netflix Lemur versions prior to 1.9.3. Any user who can authenticate to the service and run the destination read endpoints can exploit the flaw. The fix is included in release 1.9.3, which requires administrator permission for destination reads and redacts sensitive options.

The CVSS score of 7.7 indicates a moderate‑to‑high severity vulnerability. Although the EPSS score is not available and it is not listed in the CISA KEV catalog, the exposure is clear from the fact that a read‑only user can command GET /api/1/destinations or /api/1/destinations/{id}. Attackers only need valid authentication credentials; no additional configuration or public face exposure is required. Once exploited, the disclosed passwords and passphrases grant full access to the remote SFTP systems used for certificate deployment.