In Lemur versions before 1.9.2, the user password update path did not hash replacement passwords because the hashing function was only registered for the before_insert event, not before_update. As a result, when an administrator changed a user's password via the PUT /api/1/users/ endpoint, the new password was stored in plaintext in the database. This plaintext storage means that any compromise of the database, backups, replicas, or query logs could expose immediately usable credentials without requiring offline cracking. The fix in version 1.9.2 registers the password hashing function for the before_update event and ensures passwords with an existing bcrypt prefix are not rehashed.

The vulnerability leads to plaintext storage of user passwords during administrator-initiated updates, exposing credentials to immediate compromise if the database or related data stores are accessed by unauthorized parties. This undermines user authentication security and could allow attackers to impersonate users without needing to crack hashed passwords.

A fix is available in Lemur version 1.9.2 that addresses this issue by properly hashing passwords on update. Users should upgrade to version 1.9.2 or later to remediate this vulnerability. No other mitigation is indicated or required according to the vendor advisory.