Lemma's certificate management system allowed any authenticated non‑read‑only user to reference arbitrary replacement certificates without verifying ownership. This flaw lets the attacker suppress lifecycle notifications, mark a target certificate as replaced, and then include the attacker’s certificate in automatic rotation. The result is that a certificate the victim did not authorize can be deployed to all endpoints, potentially enabling man‑in‑the‑middle attacks and causing a fleet‑wide TLS failure if auto‑rotation is triggered. The weakness is a classic privilege escalation and missing authorization bug, reflected in CWE‑639 and CWE‑862.

The vulnerability affects Netflix Lemur versions 0.5.0 through 1.9.3. It was fixed in release 1.9.3, which authorizes each referenced replacement certificate before mutation. The product is used to automate TLS certificate lifecycle, and the affected code path includes certificate creation, upload, and edit operations that accept a replaces[] parameter. Updating to 1.9.3 or later resolves the flaw.

The CVSS score is 8.1, indicating a high severity. EPSS is not available, and the issue is not listed in CISA KEV, but the impact on confidentiality and availability is significant. An attacker only needs a login with non‑read‑only permissions to exploit the vulnerability via the API. Once compromised, they can silently replace certificates in the environment and trigger deployments of malicious certs to end points. This high impact combined with a straightforward API‑based attack vector warrants immediate action.