---
id: "CVE-2026-116677"
kind: "vulnerability"
aliases: ["CVE-2026-116677"]
title: "OpenWISP Controller: cross-organization CRL download exposes other tenants' revocation data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multi-tenant", "network-management", "openwisp", "package", "pki", "wifi-controller"]
not_affected_if: ["auth-required", "single-organization"]
published_at: "2026-10-27T18:17:35+00:00"
first_seen_at: "2026-10-27T18:32:59+00:00"
updated_at: "2026-10-27T18:34:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116677", "first_seen_at": "2026-10-27T18:32:59+00:00"}]
---

# OpenWISP Controller: cross-organization CRL download exposes other tenants' revocation data

OpenWISP Controller, a network and WiFi controller, lets an authenticated organization manager with CA view permission download another organization's certificate revocation list by guessing its sequential CA ID. The response can reveal CA issuer details and revoked certificate serial numbers, but not private keys or any write access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `openwisp-controller` version (for example `pip show openwisp-controller`); versions from `1.0.0` up to but not including `1.3.2` are affected
- Look for the `GET /api/v1/controller/ca/<id>/crl` endpoint in use by multi-organization deployments with CA view permissions

## Fix

- Upgrade `openwisp-controller` to `1.3.2` or later

## Timeline

- 2026-10-27T18:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116677

## From the sources

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves the CA directly instead of using the organization-scoped object retrieval enforced by FilterByOrganizationManaged, bypassing the endpoint's intended authorization boundary. The response can disclose CA issuer information and revoked certificate serial numbers, but it does not expose CA private keys or allow modification. This issue is fixed in version 1.3.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_