Warpgate is an open source bastion host for SSH, HTTPS, and MySQL on Linux. In versions before 0.28.4, the PUT endpoint /@warpgate/admin/api/users/:id/roles/:role_id calls api_update_user_role without enforcing the AdminPermission::AccessRolesAssign authorization. Consequently, any limited administrator with any permission can modify the expires_at and revoked_at fields of an existing UserRoleAssignment, effectively extending or reinstating role grants. The endpoint returns 'not found' if the user-role pair does not exist, preventing creation of new role assignments. The vulnerability is addressed in version 0.28.4.

An attacker with limited administrator permissions can extend the validity or reinstate revoked user role assignments, potentially prolonging or restoring privileges beyond intended limits. This could lead to unauthorized access persistence or privilege escalation within the warpgate environment. However, creation of new role assignments is not possible via this flaw.

Upgrade warpgate to version 0.28.4 or later, where this authorization check is properly enforced. No other mitigation is indicated by the vendor advisory.