LemonLDAP NG up to 2.16.9/2.21.5/2.23.3 Location Rules access control

Summaryinfo

A vulnerability, which was classified as problematic, was found in LemonLDAP NG up to 2.16.9/2.21.5/2.23.3. This affects an unknown function of the component Location Rules. The manipulation results in access control. This vulnerability is cataloged as CVE-2026-95811. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in LemonLDAP NG up to 2.16.9/2.21.5/2.23.3. Affected is some unknown functionality of the component Location Rules. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality. CVE summarizes:

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike. Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.

The advisory is shared for download at gitlab.ow2.org. This vulnerability is traded as CVE-2026-95811 since 09/22/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 2.16.10, 2.21.6 or 2.23.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Directory Service Software

Name

• LemonLDAP NG

Version

• 2.16.0
• 2.16.1
• 2.16.2
• 2.16.3
• 2.16.4
• 2.16.5
• 2.16.6
• 2.16.7
• 2.16.8
• 2.16.9
• 2.21.0
• 2.21.1
• 2.21.2
• 2.21.3
• 2.21.4
• 2.21.5
• 2.23.0
• 2.23.1
• 2.23.2
• 2.23.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion