CVE-2026-91167 in Warpgate
Summary
by MITRE • 09/21/2026
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
Warpgate serves as an open-source bastion host designed to secure access to Linux systems via SSH, HTTPS, and MySQL protocols. A critical authorization flaw was identified within the administrative API interface prior to version 0.28.4, specifically affecting the endpoint PUT /@warpgate/admin/api/users/:id/roles/:role_id. This endpoint invokes the api_update_user_role function through AdminContext but lacks a mandatory check for the AdminPermission::AccessRolesAssign permission. Consequently, any administrator possessing even minimal permissions can manipulate role assignments without requiring explicit authorization to manage roles, representing a significant breakdown in access control logic.
The technical nature of this vulnerability allows an attacker with limited administrative privileges to modify existing UserRoleAssignment records. Specifically, the flaw enables the modification of the expires_at field and the clearing of the revoked_at timestamp on these records. This capability effectively permits the extension of expiring role grants or the reinstatement of previously revoked permissions. By manipulating these timestamps, a low-privileged administrator can maintain access beyond intended expiration dates or restore privileges that were explicitly removed by higher-level administrators, thereby undermining the principle of least privilege and temporal security controls.
The operational impact of this vulnerability is substantial within environments relying on Warpgate for centralized identity management and access control. An attacker could escalate their effective privileges over time by repeatedly extending grants or reinstating revoked roles without detection through standard permission audits that do not monitor timestamp manipulations directly. This undermines the integrity of role-based access control policies, potentially leading to unauthorized persistence in the system. Although the vulnerability does not allow for the creation of entirely new role assignments from scratch due to validation checks requiring a matching user and role pair, it is sufficient to subvert existing security boundaries by altering the lifecycle state of valid permissions.
This issue aligns with CWE-269, which describes Improper Privilege Assignment, as well as CWE-862, Missing Authorization, since the endpoint fails to enforce required access controls for specific administrative actions. In terms of offensive cybersecurity frameworks, this behavior corresponds to ATT&CK technique T1078, Valid Accounts, specifically regarding the abuse or persistence within existing accounts by manipulating their attributes rather than creating new ones. The vulnerability was addressed in version 0.28.4 through strict enforcement of permission checks on role modification endpoints. Organizations using Warpgate should immediately upgrade to this patched version and review audit logs for any suspicious modifications to user expiration dates or revocation statuses prior to the update.