Executive brief
Warpgate is an SSH and database bastion host that manages secure access to protected systems. A scoped administrator without proper role-management permissions can modify existing role assignments to extend expired or reinstated revoked access grants. This allows a limited admin to restore access to users even after those permissions were intentionally removed or expired.
Technical details
The PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint in versions prior to 0.28.4 fails to verify AdminPermission::AccessRolesAssign before allowing modifications to UserRoleAssignment records. An authenticated scoped administrator can update expires_at and clear revoked_at fields on existing assignments, extending or reinstating access that was previously revoked or expired. The vulnerability requires an existing role assignment to modify—attackers cannot create new assignments through this endpoint.
Affected products
- Warptech Warpgate before 0.28.4
Timeline
- 2026-09-21: disclosed
- 2026-08-26: patched: Released in v0.28.4