Lemur, a TLS certificate management tool, had a vulnerability (CVE-2026-55163) in versions before 1.9.2 where the PUT /api/1/roles/<id> endpoint authorized updates based on membership in the target role rather than requiring administrator privileges. This allowed any non-admin member of a role to add or remove users from that role and rename it, enabling lateral privilege escalation and potential denial of access to legitimate members. The DELETE handler already required admin permissions, so the PUT handler's weaker authorization was inconsistent. The vulnerability is fixed in version 1.9.2 by enforcing administrator-only access for the PUT handler.

An attacker who is a non-admin member of a role can escalate privileges by modifying role membership and renaming roles that control certificate and authority access. This could lead to unauthorized access to TLS certificates or denial of access to legitimate users. The vulnerability has a CVSS 3.1 score of 6.3 (medium severity), indicating a moderate impact on confidentiality, integrity, and availability.

Upgrade Lemur to version 1.9.2 or later, where the PUT /api/1/roles/<id> endpoint requires administrator privileges to update roles. This official fix corrects the authorization flaw and prevents non-admin users from modifying role membership or names.