CVE-2024-52946: Lemonldap-NG

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication level if the admin configured an "Adaptative authentication rule" with an increment instead of an absolute value.

Affected products

• Lemonldap-NG Lemonldap-NG: before 2.20.1 (fixed in 2.20.1)

Published 2024-11-18. Last modified 2026-06-17.