CVE-2026-91167 Details
Description
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.
A vulnerability in Warpgate prior to version 0.28.4 allows administrators to bypass permission checks on the user role update API endpoint. The affected endpoint, PUT /@warpgate/admin/api/users/:id/roles/:role_id, does not require the AdminPermission::AccessRolesAssign permission, enabling limited administrators to extend or reinstate access role grants. This issue arises because the endpoint lacks proper authorization, allowing any admin to manipulate role assignments without the necessary permissions.
Users should update to Warpgate version 0.28.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/warp-tech/warpgate/commit/c020900a9d85989e4280bd03184976bc33e2e61d | [email protected] | Source CodeVendor |
| https://github.com/warp-tech/warpgate/releases/tag/v0.28.4 | [email protected] | Release NotesVendor |
| https://github.com/warp-tech/warpgate/security/advisories/GHSA-fjgc-484v-j6mf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WarpGate | <= 0.28.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |