Detections
Analytics
SCA: security update for openwisp-controller (GHSA-9gh4-xw24-9xh5)
medium Tenable Cloud Security Plugin ID 478101
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates,
and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows
an authenticated organization manager with CA view permission to retrieve another organization's
certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves
the CA directly instead of using the organization-scoped object retrieval enforced by
FilterByOrganizationManaged, bypassing the endpoint's intended authorization boundary. The response can
disclose CA issuer information and revoked certificate serial numbers, but it does not expose CA private
keys or allow modification. This issue is fixed in version 1.3.2. (CVE-2026-116677)
Solution
Update the openwisp-controller library and its related packages to version 1.3.2 or later.See Also
Plugin Details
Severity: Medium
ID: 478101
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/31/2026
Updated: 10/31/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2026-116677
CVSS v3
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.3
Threat Score: 1.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/30/2026
Vulnerability Publication Date: 10/27/2026
Reference Information
CVE: CVE-2026-116677
cwe: CWE-862