CVE-2026-55163: Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPerm

Executive brief

Netflix Lemur is a certificate management framework used to manage TLS/SSL certificates. A security flaw allows any user who is a member of a specific role to modify that role's membership and name. This means a non-privileged user could grant other users access to sensitive certificates or authorities, or disrupt operations by removing legitimate users from their assigned roles.

Technical details

An incorrect authorization check in 'lemur/roles/views.py' allows any member of a role to perform updates on that role. The 'PUT' handler uses 'RoleMemberPermission', which incorrectly grants access if the user is either an administrator or a member of the target role, whereas the 'DELETE' handler correctly requires administrative privileges. An authenticated attacker with low privileges can add or remove users from roles they already belong to, potentially gaining lateral access to certificate authorities or certificate management functions. The vulnerability is addressed in version 1.9.2 by enforcing administrative requirements on the affected endpoint.

Affected products

• Netflix Lemur <= 1.9.1

Timeline

• 2026-06-10: disclosed: Initial disclosure to Netflix/lemur
• 2026-06-25: advisory: GitHub Advisory published
• 2026-06-25: patched: Version 1.9.2 released

References

• https://api.github.com/users/sour-exploit
• https://github.com/sour-exploit
• https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D
• https://api.github.com/users/sour-exploit/repos
• https://avatars.githubusercontent.com/u/288231323?v=4
• https://api.github.com/users/sour-exploit/events%7B/privacy%7D