CVE-2026-55163

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55163", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T15:13:28.165Z", "datePublished": "2026-08-18T18:50:58.130Z", "dateUpdated": "2026-08-19T18:21:06.074Z"}, "containers": {"cna": {"title": "Lemur: Privilege escalation via PUT /api/1/roles/<id> \u2014 non-admin role members can rewrite role membership", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785"}, {"name": "https://github.com/Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce", "tags": ["x_refsource_MISC"], "url": "https://github.com/Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce"}, {"name": "https://github.com/Netflix/lemur/releases/tag/v1.9.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Netflix/lemur/releases/tag/v1.9.2"}], "affected": [{"vendor": "Netflix", "product": "lemur", "versions": [{"version": "< 1.9.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T18:50:58.130Z"}, "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data[\"users\"] and data[\"name\"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2."}], "source": {"advisory": "GHSA-x3vf-mgxj-7785", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T18:04:06.102873Z", "id": "CVE-2026-55163", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:21:06.074Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55163", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T18:04:06.102873Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:04:07.272Z"}}], "cna": {"title": "Lemur: Privilege escalation via PUT /api/1/roles/<id> \u2014 non-admin role members can rewrite role membership", "source": {"advisory": "GHSA-x3vf-mgxj-7785", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Netflix", "product": "lemur", "versions": [{"status": "affected", "version": "< 1.9.2"}]}], "references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785", "name": "https://github.com/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce", "name": "https://github.com/Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.2", "name": "https://github.com/Netflix/lemur/releases/tag/v1.9.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data[\"users\"] and data[\"name\"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T18:50:58.130Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55163", "state": "PUBLISHED", "dateUpdated": "2026-08-19T18:21:06.074Z", "dateReserved": "2026-06-16T15:13:28.165Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T18:50:58.130Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lemur", "vendor": "Netflix", "versions": [{"status": "affected", "version": "< 1.9.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data[\"users\"] and data[\"name\"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2."}, {"lang": "es", "value": "Lemur gestiona la creaci\u00f3n de certificados TLS. Antes de la versi\u00f3n 1.9.2, PUT /API/1/roles/ en lemur/roles/views.py:298 autorizaba las actualizaciones con RoleMemberPermission(role_id), lo que permit\u00eda a un administrador o a cualquier miembro existente del rol objetivo. El gestor pasaba data[\u2019users\u2019] y data[\u2019name\u2019] a service.update, permitiendo a un miembro no administrador a\u00f1adir o eliminar otros usuarios y renombrar el rol. Esto permit\u00eda la concesi\u00f3n lateral de privilegios dentro de roles que controlan el acceso a certificados y autoridades, y pod\u00eda denegar el acceso eliminando a miembros leg\u00edtimos. El gestor DELETE ya requer\u00eda admin_permission, confirmando que la autorizaci\u00f3n PUT m\u00e1s d\u00e9bil era inconsistente. La soluci\u00f3n aplica el mismo requisito de solo administrador al gestor PUT. Este problema se ha solucionado en la versi\u00f3n 1.9.2."}], "id": "CVE-2026-55163", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55163", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T18:04:06.102873Z", "version": "2.0.3"}}]}, "published": "2026-08-18T19:16:58.357", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/commit/9523a3b9cb3170ec9f795162b8c60e1ad3c4f9ce"}, {"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/releases/tag/v1.9.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-x3vf-mgxj-7785"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "lemur", "source": "cna", "vendor": "Netflix"}, "product": "lemur", "vendor": "netflix"}], "created": "2026-08-18T20:45:04.334136+00:00", "updated": "2026-08-18T20:45:04.516989+00:00", "vendors": ["netflix", "netflix$PRODUCT$lemur"]}