This vulnerability occurs in Lemonldap::NG::Handler when a request URI is percent‑encoded or contains dot segments or double slashes, causing the raw request line that the handler matches against locationRules to differ from the server‑decoded path used for authorization. As a result, a protected resource can be reached under a URI that does not match any locationRules, and the virtual host’s default rule is applied. The effect is that denial, identity, group, and skip rules are all bypassed, allowing an authenticated user to access any URL that the locationRules were intended to restrict, but no more privileged than its default rule would normally grant.

The product affected is Lemonldap‑NG‑Handler (Perl). Versions impacted are all releases from 2.0.0 up to 2.16.9, from 2.17.0 up to 2.21.5, and from 2.22.0 up to 2.23.3. Only a virtual host whose default rule is more permissive than its explicit locationRules can be affected. The issue is present in the Perl implementation of the handler.

A web attacker can exploit this by crafting a URL that percent‑encodes a path character, inserts dot segments, or doubles a slash, causing the request to bypass the intended access controls. While the vulnerability does not provide outright remote code execution, it enables unauthorized access to resources that the default rule otherwise would block. The attacker must be authenticated to the service. With a CVSS score of 6.5 and an EPSS score of less than 1 %, the vulnerability is considered moderate in severity and is unlikely to be widely exploited. It is not listed in CISA’s KEV catalog, indicating no known large‑scale exploit seen. The risk remains significant for configurations where the default rule is more permissive than the explicit locationRules.