CVE-2026-55164
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Lemur before version 1.9.2 has a vulnerability in lemur.users.service.update that assigns a replacement password directly to users.password, without invoking hash_password (registered only for the before_insert event). As a result, administrator-initiated password changes via PUT /api/1/users/ are stored in plaintext, preventing normal login and exposing passwords.
Risk Assessment
If the database, backup, or logs are compromised, an attacker could gain immediate access to passwords without offline cracking, posing a serious threat to account security.
Recommendation
Upgrade Lemur to version 1.9.2 or later, which registers hashing for before_update and avoids rehashing values with a bcrypt prefix.
Original NVD description (English source)
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.