Authorization Bypass in OpenWISP Controller Affects Network and WiFi Management
CVE-2026-116677

5.3MEDIUM

Key Information:

Vendor

Openwisp

Status
Openwisp-controller
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116677?

The OpenWISP Controller allows organizational managers with certificate authority (CA) view permissions to access another organization's certificate revocation list (CRL) through an insecure API endpoint. This flaw enables unauthorized retrieval of sensitive CA issuer data and revoked certificate serial numbers. While this issue does not grant access to CA private keys or modifications, it compromises the integrity of sensitive certificate management processes. The vulnerability has been addressed in version 1.3.2, highlighting the importance of updating to mitigate potential risks.

Affected Version(s)

openwisp-controller >= 1.0.0, < 1.3.2

References

https://github.com/openwisp/openwisp-controller/security/...
x_refsource_CONFIRM
https://github.com/openwisp/openwisp-controller/commit/90...
x_refsource_MISC
https://github.com/openwisp/openwisp-controller/commit/9e...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.