Privilege escalation via incorrect PUT authorization

Incorrect authorization in Netflix Lemur before 1.9.2 allows remote authenticated users to rewrite roles via PUT /api/1/roles/. In lemur/roles/views.py, Roles.put calls RoleMemberPermission(role_id).can() and then passes the name and users fields to service.update(), so any existing member of the target role can rename it and replace its membership list. Exploitation requires only membership in the role being edited and can grant peer access to certificate or authority resources or deny access by removing legitimate members.