The flaw allows any authenticated user who is not read‑only, when ADMIN_ONLY_AUTHORITY_CREATION is set to false, to create a new sub‑CA under a parent authority without providing AuthorityPermission. The parent authority’s private key is then used by the backend issuer to sign the new intermediate, and the resulting key material may be extracted and used outside Lemur. This grants an attacker the ability to issue certificates trusted by clients that rely on the parent root, effectively bypassing all issuance controls and compromising the integrity of the certificate ecosystem.

Netflix Lemur, versions prior to 1.9.3. The vulnerability is triggered by POST /api/1/authorities requests with type=subca. Users with any authenticated role that is not read‑only are affected in configurations where ADMIN_ONLY_AUTHORITY_CREATION is disabled.

With a CVSS score of 6.5 the risk is moderate but significant. EPSS data is not available, and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation. The likely attack vector is authenticated remote API usage; any user who can submit the creation request can chain a sub‑CA to an internal root, issuing certificates that clients will trust and giving the attacker a foothold for further attacks.