CVE-2026-91167: Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expiresat on an existing UserRoleAssignment and clear revokedat, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
warpgateto a version that resolves this vulnerability.Fixed in 0.28.4 - Compensating control
If upgrading to 0.28.4 is not immediately possible, restrict access to PUT /@warpgate/admin/api/users/:id/roles/:role_id so only admins who have AdminPermission::AccessRolesAssign can reach it.
Event History
Frequently Asked Questions
Which administrators can exploit this issue?
Any limited administrator that has at least one administrative permission can exploit the affected endpoint; the administrator does not need the AccessRolesAssign permission.
What access is required to exploit it?
An attacker needs authenticated administrative access capable of calling PUT /@warpgate/admin/api/users/:id/roles/:role_id. The issue affects existing user-role assignments only.
Can this be used to grant a completely new role to a user?
No. The endpoint cannot create an assignment where the specified user and role pair did not already exist, and returns not found when no matching assignment exists.
What can an attacker do to an existing assignment?
They can modify expires_at to extend an expiring grant and clear revoked_at to reinstate a revoked grant.
What version fixes the issue?
Upgrade Warpgate to version 0.28.4, which includes the authorization check for AccessRolesAssign.