CVE-2026-116677: OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

Q: Who can exploit this issue?

An authenticated organization manager who has permission to view a CA can exploit it. The attacker must know or enumerate another CA's sequential integer identifier.

Q: What information can be exposed?

The endpoint can disclose another organization's certificate revocation list, including CA issuer information and revoked certificate serial numbers. It does not disclose CA private keys and does not permit modification.

Q: Are deployments affected by default?

Affected versions are 1.0.0 through versions before 1.3.2 when the CA CRL REST endpoint is available to an authenticated organization manager with CA view permission. The issue is an authorization-scoping failure rather than an unauthenticated access issue.

Q: What should be done if patching cannot happen immediately?

Restrict CA view permission and organization-manager access to only trusted users, since those permissions are required to retrieve CRLs across organization boundaries. Monitor requests to /api/v1/controller/ca/<integer-id>/crl for access to CA identifiers outside a user's managed organizations.

Published Oct 27, 2026

Updated

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves the CA directly instead of using the organization-scoped object retrieval enforced by FilterByOrganizationManaged, bypassing the endpoint's intended authorization boundary. The response can disclose CA issuer information and revoked certificate serial numbers, but it does not expose CA private keys or allow modification. This issue is fixed in version 1.3.2.

Affected Software

1 affected component

OpenWISP OpenWISP Controller>=1.0.0<1.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenWISP Controller to a version that resolves this vulnerability.
Fixed in 1.3.2

Event History

Oct 27, 2026

CVE Published

via MITRE·05:23 PM

Data Sourced

via MITRE·05:23 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated organization manager who has permission to view a CA can exploit it. The attacker must know or enumerate another CA's sequential integer identifier.

What information can be exposed?

The endpoint can disclose another organization's certificate revocation list, including CA issuer information and revoked certificate serial numbers. It does not disclose CA private keys and does not permit modification.

Are deployments affected by default?

Affected versions are 1.0.0 through versions before 1.3.2 when the CA CRL REST endpoint is available to an authenticated organization manager with CA view permission. The issue is an authorization-scoping failure rather than an unauthenticated access issue.

What should be done if patching cannot happen immediately?

Restrict CA view permission and organization-manager access to only trusted users, since those permissions are required to retrieve CRLs across organization boundaries. Monitor requests to /api/v1/controller/ca/<integer-id>/crl for access to CA identifiers outside a user's managed organizations.

How can administrators determine whether they are affected?

Deployments running OpenWISP Controller versions from 1.0.0 through before 1.3.2 are affected. Testing with an organization manager that has CA view permission can confirm the issue if it can retrieve a CRL using the identifier of a CA belonging to a different organization.