{"apiVersion":"1.0","identifier":"CVE-2026-55164","description":"Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.","publishedAt":"2026-08-18T19:16:58","lastModifiedAt":"2026-08-18T20:17:18","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55164","cvssScore":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","epssProbability":0.00234,"riskScore":0.5,"affectedProduct":"Lemur","affectedVersions":"<1.9.2","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-55164","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-55164","en":"https://www.redsauce.net/en/cves/CVE-2026-55164","fr":"https://www.redsauce.net/fr/cves/CVE-2026-55164","pt":"https://www.redsauce.net/pt/cves/CVE-2026-55164","de":"https://www.redsauce.net/de/cves/CVE-2026-55164","sk":"https://www.redsauce.net/sk/cves/CVE-2026-55164","el":"https://www.redsauce.net/el/cves/CVE-2026-55164"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-55164"}}