Vulnerability Description
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data["users"] and data["name"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce
- https://github.com/Netflix/lemur/releases/tag/v1.9.2
- https://github.com/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785
FAQ
What is CVE-2026-55163?
CVE-2026-55163 is a vulnerability with a CVSS score of 6.3 (MEDIUM). Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or an...
How severe is CVE-2026-55163?
CVE-2026-55163 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55163?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.