CVE-2026-80110

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.

Rated Important: an authenticated Certificate Manager Agent -- a non-administrative role -- can author and activate an arbitrary certificate-issuance profile, an operation meant to require Administrator privilege. This directly compromises the integrity of the CA's issuance policy and poses a confidentiality risk to relying parties trusting the resulting certificates. Not Critical, since it requires an existing authenticated credential rather than unauthenticated remote code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no way to mitigate this issue other than applying an update once available. As a partial mitigation, limiting membership in the Certificate Manager Agents group to trusted users reduces exposure, since exploitation requires an authenticated credential in that role.