{"cve":"CVE-2026-55163","nvd":{"published":"2026-08-18T19:16:58.357","modified":"2026-10-22T22:10:00.250","status":"Deferred","description":"Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data[\"users\"] and data[\"name\"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cwes":["CWE-863"],"references":["https://github.com/Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce","https://github.com/Netflix/lemur/releases/tag/v1.9.2","https://github.com/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785"],"products":[],"source":"nvd","synced_at":"2026-10-23T16:39:26.291718493+00:00"},"epss":{"cve":"CVE-2026-55163","score":0.00216,"percentile":0.11919,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-x3vf-mgxj-7785","url":"https://osv.dev/vulnerability/GHSA-x3vf-mgxj-7785","summary":"Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>","modified":"2026-07-13T16:42:41.442313132Z","packages":[{"ecosystem":"PyPI","name":"lemur","purl":"pkg:pypi/lemur","ranges":["<1.9.2"],"fixed":["1.9.2"]}]},{"id":"PYSEC-2026-2591","url":"https://osv.dev/vulnerability/PYSEC-2026-2591","summary":"Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>","modified":"2026-07-13T16:32:03.185964395Z","packages":[{"ecosystem":"PyPI","name":"lemur","purl":"pkg:pypi/lemur","ranges":["<1.9.2"],"fixed":["1.9.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}