CVE-2026-116677 openwisp CVE debrief

Who should care

Defenders responsible for OpenWISP Controller deployments, particularly those with multiple organizations or users with manager roles, should assess exposure and prioritize patching to prevent potential misuse.

Why it matters

CVE-2026-116677 is a vulnerability in OpenWISP Controller's CA CRL REST API that allows an organization manager to retrieve CRLs for CAs belonging to other organizations. Defenders should prioritize patching, assess exposure, and monitor for potential misuse.

• An authenticated organization manager may be able to retrieve CRLs for CAs belonging to other organizations
• The vulnerability requires an organization manager to have CA view permission and enumerate sequential CA integer IDs
• The impact is limited to the exposure of Certificate Revocation Lists, not the compromise of CAs or issuance of unauthorized certificates
• Verification of patch application and monitoring for misuse are recommended

Technical summary

The OpenWISP Controller's CA CRL REST API endpoint does not properly apply organization-scoped access control, allowing an authenticated organization manager with CA view permission to retrieve the CRL for a CA belonging to another organization by enumerating sequential CA integer IDs. This vulnerability requires an organization manager to have CA view permission and enumerate sequential CA integer IDs. The impact is limited to the exposure of Certificate Revocation Lists, not the compromise of CAs or issuance of unauthorized certificates. Verification of patch application and monitoring for misuse are recommended. The sibling CA detail endpoint is correctly organization-scoped and returns 404 for the same

Defensive priority

Defenders should prioritize verifying and applying the patch for OpenWISP Controller version 1.3.2, assessing exposure in their environments, and monitoring for potential misuse.

Recommended defensive actions

• Verify and apply the patch for OpenWISP Controller version 1.3.2
• Assess exposure in OpenWISP Controller deployments
• Monitor for potential misuse of the vulnerable API endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in OpenWISP Controller's CA CRL REST API, which does not properly scope requests to managed organizations, allowing an organization manager to retrieve the CRL for a CA belonging to another organization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.