CVE-2026-55163

Lemur (Netflix TLS certificate management tool) has an authorization bypass in PUT /api/1/roles/ (lemur/roles/views.py:298): RoleMemberPermission uses OR-semantics, so any existing role member can add/remove other users and rename the role. The companion DELETE handler already required admin perm...