CVE-2020-24660

CVE-2020-24660 describes a critical access control bypass vulnerability affecting LemonLDAP::NG versions through 2.0.8 when used with NGINX, and also earlier versions of the "Lemonldap::NG handler for Node.js" package. An unauthenticated attacker can exploit this by submitting a non-normalized URI to bypass URL-based access controls on protected Virtual Hosts, leading to complete compromise of confidentiality, integrity, and availability. Despite its CVSS score of 9.8 (Critical) and high FAUCET Risk Score, there is currently no evidence of active exploitation, public exploit code, or significant community discussion or media coverage.