Warpgate is an open‑source bastion host that exposes an HTTP API for administrative tasks. A missing authorization check on the endpoint that updates a user’s role allows any administrator who can authenticate to the API to modify the expiration date and revocation status of an existing UserRoleAssignment. Because the endpoint accepts requests for any user–role pair that already exists, a limited admin with any permission can effectively revoke or re‑grant roles, extending privileges beyond the limits defined by the AccessRolesAssign permission. The flaw is a classic privilege escalation through authorization bypass, identified as CWE‑862.

Applicable to the warp-tech Warpgate product, version numbers prior to 0.28.4 are affected. The vulnerability resides in the admin context handling of the endpoint PUT /@warpgate/admin/api/users/:id/roles/:role_id, which is invoked from warpgate-admin/src/api/users.rs. All installations of Warpgate that expose the admin API without applying the fix are potentially vulnerable. The issue is fixed in release v0.28.4 and later.

Although the CVSS base score is 6, indicating a medium risk, the vulnerability is exploitable by any authenticated administrator regardless of assigned permissions. The EPSS score is not available, but the lack of a restriction on the target user or role suggests that attack opportunities are likely if an attacker gains admin access to the API. The issue is not yet listed in the CISA KEV catalog. The typical attack vector is via the authenticated admin HTTP API; an attacker who can authenticate as an admin can send a crafted PUT request to extend an expiring grant or reinstate a revoked one.