CyberRota Analysis
AI-GeneratedLemur versions prior to 1.9.2 have a vulnerability in the role management API that allows non-admin users to modify role memberships and rename roles, potentially leading to unauthorized access to TLS certificate management. This inconsistency in permission checks can enable lateral privilege escalation and disrupt legitimate access by removing authorized users. Organizations using Lemur for TLS certificate management should prioritize upgrading to version 1.9.2 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data["users"] and data["name"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2.