What’s Vulnerable › Vulnerabilities

CVE-2026-55163: Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-18 · updated 2026-10-22
• Weakness: CWE-863

Description

Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data["users"] and data["name"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2.

Affected products

• Netflix lemur: before 1.9.2

References

• https://github.com/Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce
• https://github.com/Netflix/lemur/releases/tag/v1.9.2
• https://github.com/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785

Get alerted when CVE-2026-55163 or the next vulnerability affects your stack