Description

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-21T15:17:32.060Z",
  "pubdate": "2026-09-21T15:17:32.060Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists in the pki-core v2 REST ACL filter due to an improper implementation of permission tie-breaking logic. The vulnerability affects the CA's profile-management REST API, allowing lower-privileged users to circumvent access controls. By exploiting the flaw in how the system handles colliding literal and wildcard ACL keys, an authenticated attacker can elevate their privileges to perform unauthorized actions intended only for administrators. The impact includes a compromise of the integrity and confidentiality of the certificate authority's issuance policy, as unauthorized parties can manipulate sensitive profile configurations. Successful exploitation requires the attacker to hold lower-level permissions, such as those assigned to the Certificate Manager Agents group, and leverage the predictability of lexicographical ACL evaluation to trigger an unauthorized operation on the /v2/profiles/raw endpoint.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of the ACL resolution logic within the pki-core v2 REST ACL filter. When the filter processes incoming requests, it must determine which permission governs a specific resource. The system fails to evaluate permission specificity—whereby a literal key match should take precedence over a wildcard key match—and instead relies on a lexicographical string comparison to resolve collisions between these two types of entries.\nThe vulnerability is specifically triggered within the CA's profile-management REST API. When a request is made to the POST /v2/profiles/raw endpoint, the system attempts to validate the user's credentials against the defined ACLs. The intended behavior is to mandate the 'profiles.create' permission, which is restricted to Administrator-level users. However, due to the flawed tie-breaking mechanism, if a wildcard-mapped permission (such as 'profiles.approve') is present in the configuration and sorts 'less than' or 'greater than' the 'profiles.create' key based on the flawed lexicographical logic, the system incorrectly assigns the wildcard permission as the governing rule for the request.\nAn attacker possessing the 'profiles.approve' permission—a privilege typically held by the Certificate Manager Agents group—can exploit this behavior to access the /v2/profiles/raw endpoint. Because the filter erroneously identifies the attacker's lower-privileged wildcard permission as the authorized level for the requested resource, the access control check is bypassed, allowing the POST request to proceed without the required administrative authorization.\nThe attack flow proceeds as follows: First, an attacker authenticates as a user with Certificate Manager Agent privileges. Second, the attacker targets the /v2/profiles/raw endpoint with a POST request. Third, the pki-core ACL filter intercepts the request and performs a lookup for matching permissions. Fourth, the system identifies both a literal 'profiles.create' requirement and a wildcard 'profiles.approve' match. Fifth, the flawed tie-breaking algorithm resolves the conflict in favor of the wildcard permission due to lexicographical ordering. Sixth, the system grants the request, resulting in unauthorized modification of certificate profiles. The successful exploitation of this flaw enables an attacker to manipulate issuance policies, potentially leading to the unauthorized issuance of certificates or the corruption of existing infrastructure security settings."
}