CVE-2026-71307

### Summary Lemur's destination read endpoints -- `GET /api/1/destinations` and `GET /api/1/destinations/<id>` -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints (`POST`/`PUT`/`DELETE`) are gated with `@admin_permission.require(http_exception=403)`, but the two read handlers are protected only by `login_required` (inherited from `AuthenticatedResource`). They do not even exclude `read-only` users. The built-in SFTP destination plugin (`sftp-destination`) stores its `password` and `privateKeyPass` options in cleartext in the `destinations.options` column (the plugin's own docstring states "Passwords are not encrypted and stored as a plain text."). Because `DestinationOutputSchema` serializes every option value verbatim, any authenticated principal -- including a `read-only` user -- can retrieve these credentials and use them to authenticate to the remote SFTP server to which Lemur deploys certificates. ### Details Read endpoints lack the authorization that their write siblings enforce: `lemur/destinations/views.py` ```python class DestinationsList(AuthenticatedResource): @validate_schema(None, destinations_output_schema) def get(self): # <-- only login_required; no admin/read-only gate ... return service.render(args) @validate_schema(destination_input_schema, destination_output_schema) @admin_permission.require(http_exception=403) # write path IS gated def post(self, data=None): ... class Destinations(AuthenticatedResource): @validate_schema(None, destination_output_schema) def get(self, destination_id): # <-- only login_required; no admin/read-only gate return service.get(destination_id) @validate_schema(destination_input_schema, destination_output_schema) @admin_permission.require(http_exception=403) # write path IS gated def put(self,