CVE-2026-55163 json
Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership
published 2026-06-25 4 mo ago modified 2026-10-22 17 d ago also EUVD-2026-61147 , GHSA-x3vf-mgxj-7785 , PYSEC-2026-2591
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data["users"] and data["name"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2.
Patch / fix
- pypi lemur 1.9.2
- netflix lemur 1.9.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | lemur | <1.9.2 |
1.9.2 |
Affected products
- Netflix lemur
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
- github.com /Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce
-
github.com
/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785
web
-
github.com
/Netflix/lemur/releases/tag/v1.9.2
web
-
github.com
/Netflix/lemur
package
-
pypi.org
/project/lemur
package
-
github.com
/advisories/GHSA-x3vf-mgxj-7785
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-55163
advisory
Sources
- CVE List CVE-2026-55163
- GitHub Advisory GHSA-x3vf-mgxj-7785
- NVD CVE-2026-55163
- OSV PYSEC-2026-2591
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.