CVE-2026-71303

### Summary The fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme_url` values not in `ACME_DIRECTORY_HOST_ALLOWLIST`, but the validation is only called at **authority creation time** (POST). The authority **update** endpoint (`PUT /api/1/authorities/<id>`) accepts and stores arbitrary `options` -- including a modified `acme_url` -- without invoking the allowlist check. Any user with an authority role (granted by an admin to allow issuing certificates via that authority) can therefore overwrite the stored `acme_url` with an internal IP or IMDS endpoint. The next certificate issuance via that authority causes Lemur's backend to fetch the attacker-controlled URL, achieving SSRF. ### Details **Where the fix lives (POST path -- protected):** `lemur/plugins/lemur_acme/plugin.py` lines 333-337 (ACMEIssuerPlugin.create_authority): ```python for option in plugin_options: if option.get("name") == "certificate": acme_root = option.get("value") if option.get("name") == "acme_url": _validate_acme_url(option.get("value", "")) # allowlist enforced ``` `_validate_acme_url` at line 35: ```python def _validate_acme_url(url): """Reject acme_url values that are not in the configured allowlist. Called at authority creation time only -- existing authorities in the DB were already trusted when they were created and are not re-validated. """ allowed_hosts = current_app.config.get( "ACME_DIRECTORY_HOST_ALLOWLIST", {"acme-v02.api.letsencrypt.org", ...}, ) parsed = urlparse(url) if parsed.scheme != "https" or parsed.hostname not in allowed_hosts: raise InvalidConfiguration(...) ``` **Where the gap is (PUT path -- unprotected):** `lemur/authorities/views.py` lines 405-424 (`Authorities.put`): ```python authority = service.get(authority_id) roles = [x.name for x in authority.roles] permission = AuthorityPermission(authority_id, roles) if not permission.can() or not StrictRolePermiss