CVE-2026-55163
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Lemur before version 1.9.2 has a vulnerability in PUT /api/1/roles/ that authorizes updates based on role membership rather than administrator-only. This allows a non-admin member to add or remove other users and rename the role, potentially leading to privilege escalation and denial of access.
Risk Assessment
An attacker could exploit this to grant unauthorized privileges in roles controlling certificates and authorities, or remove legitimate members, potentially disrupting system operations.
Recommendation
Upgrade Lemur to version 1.9.2 or later, which requires administrator permission for PUT operations on roles.
Original NVD description (English source)
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data["users"] and data["name"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2.