{"id":"CVE-2026-116677","kind":"vulnerability","aliases":["CVE-2026-116677"],"related":[],"title":"OpenWISP Controller: cross-organization CRL download exposes other tenants' revocation data","description":"OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves the CA directly instead of using the organization-scoped object retrieval enforced by FilterByOrganizationManaged, bypassing the endpoint's intended authorization boundary. The response can disclose CA issuer information and revoked certificate serial numbers, but it does not expose CA private keys or allow modification. This issue is fixed in version 1.3.2.","summary":"OpenWISP Controller, a network and WiFi controller, lets an authenticated organization manager with CA view permission download another organization's certificate revocation list by guessing its sequential CA ID. The response can reveal CA issuer details and revoked certificate serial numbers, but not private keys or any write access.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","network-management","openwisp","package","pki","wifi-controller"],"not_affected_if":["auth-required","single-organization"],"how_to_check":"- Check the installed `openwisp-controller` version (for example `pip show openwisp-controller`); versions from `1.0.0` up to but not including `1.3.2` are affected\n- Look for the `GET /api/v1/controller/ca/<id>/crl` endpoint in use by multi-organization deployments with CA view permissions","fix":"- Upgrade `openwisp-controller` to `1.3.2` or later","status":"open","published_at":"2026-10-27T18:17:35+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:34:57+00:00","updated_at":"2026-10-27T18:34:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T18:34:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `openwisp-controller` to `1.3.2` or later","reach":"internet","title":"OpenWISP Controller: cross-organization CRL download exposes other tenants' revocation data","impact":"low","summary":"OpenWISP Controller, a network and WiFi controller, lets an authenticated organization manager with CA view permission download another organization's certificate revocation list by guessing its sequential CA ID. The response can reveal CA issuer details and revoked certificate serial numbers, but not private keys or any write access.","category":"package","nicknames":[],"who_cares":["openwisp","network-management","wifi-controller","pki","multi-tenant"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated manager reads other organizations' CRL and revoked serial numbers.","analyst_note":"","how_to_check":"- Check the installed `openwisp-controller` version (for example `pip show openwisp-controller`); versions from `1.0.0` up to but not including `1.3.2` are affected\n- Look for the `GET /api/v1/controller/ca/<id>/crl` endpoint in use by multi-organization deployments with CA view permissions","needs_analyst":false,"not_affected_if":["single-organization","auth-required"],"who_is_affected":"Deployments running OpenWISP Controller 1.0.0 through 1.3.1 with more than one organization, where some users hold CA view permission in one organization and could reach CA records of another. Single-organization installs have no other tenant's CA to reach, and anyone without an authenticated organization-manager account cannot call the endpoint.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3479,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116677':15A,18A '-2026':14A,17A '/api/v1/controller/ca':102C '/crl':103C '1.0.0':97C '1.3.2':99C,181C 'access':79B 'allow':105C,173C 'anoth':48B,116C 'authent':40B,107C 'author':150C 'boundari':151C 'bypass':145C 'ca':44B,58B,64B,111C,126C,131C,156C,169C 'certif':51B,69B,119C,161C 'configur':90C 'control':2A,30B,32B,37B,81C,87C 'crl':6A 'crldownloadview.retrieve':128C 'cross':4A 'cross-organ':3A 'cve':13A,16A 'data':12A 'detail':66B 'direct':132C 'disclos':155C 'download':7A,47B 'endpoint':104C,147C 'enforc':142C 'expos':8A,168C 'filterbyorganizationmanag':144C 'fix':178C 'get':101C 'guess':55B 'id':59B 'identifi':127C 'inform':158C 'instead':133C 'intend':149C 'issu':176C 'issuer':65B,157C 'key':75B,171C 'let':38B 'list':53B,121C 'manag':24B,42B,91C,95C,109C 'modif':174C 'multi':20B 'multi-ten':19B 'network':23B,34B,84C 'network-manag':22B 'number':71B,163C 'object':140C 'openwisp':1A,25B,31B,80C 'organ':5A,41B,49B,108C,117C,138C 'organization-scop':137C 'packag':26B 'permiss':46B,113C 'pki':27B,94C 'privat':74B,170C 'provis':89C 'request':123C 'resolv':129C 'respons':61B,153C 'retriev':115C,141C 'reveal':63B 'revoc':11A,52B,120C 'revok':68B,160C 'scope':139C 'sequenti':57B,125C 'serial':70B,162C 'tenant':10A,21B 'updat':92C 'use':135C 'version':180C 'view':45B,112C 'wifi':29B,36B,86C 'wifi-control':28B 'write':78B","nicknames":[],"mitigations":[],"who_affected":"Deployments running OpenWISP Controller 1.0.0 through 1.3.1 with more than one organization, where some users hold CA view permission in one organization and could reach CA records of another. Single-organization installs have no other tenant's CA to reach, and anyone without an authenticated organization-manager account cannot call the endpoint.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116677","severity":null,"published_at":"2026-10-27T18:17:35+00:00","modified_at":"2026-10-27T18:17:35+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}