CVE-2026-91167

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91167

Warpgate , an open-source SSH/HTTPS/MySQL bastion host for Linux, has a missing authorization check in the PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint. The handler api_update_user_role in warpgate-admin/src/api/users.rs routes through AdminContext but does not require AdminPermissi...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91167: Missing Authorization

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...