The vulnerability resides in Lemur’s role update endpoint. The PUT /api/1/roles/<id> endpoint authenticates using RoleMemberPermission, which incorrectly permits any member of the role – not just administrators – to perform updates. The data supplied in the request (the users list and the role name) is forwarded directly to the service layer, allowing a non‑admin member to add or remove users from the role and to rename the role. This bypasses intended role‑based access control and enables a non‑admin member to grant other users additional privileges or revoke legitimate members, thereby achieving lateral privilege escalation and potentially denying legitimate access to certificates and authorities. The flaw is a classic role‑based access control bypass (CWE‑863).

Vendors: Netflix’s Lemur, a TLS certificate management service. The issue impacts all installations running Lemur versions earlier than 1.9.2. Versions 1.9.2 and newer contain the fix.

The CVSS score is 6.3, reflecting moderate severity. An attacker needs to be an existing member of the target role, which may be obtained through legitimate credentials or social engineering. Once authenticated, the attacker can install or remove users from a role that controls certificate creation and authority access, effectively escalating privileges or disrupting operations. The EPSS score is not published, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. The attack vector is local or network, requiring authenticated access via the REST API. The mismatch in permission checks renders the exploitation straightforward.