Warpgate EUVD-2026-84065

Requires an authenticated Warpgate limited administrator account holding any admin permission (PR:L) - this is not remote-unauthenticated. Deployment must use delegated/limited admin roles rather than a single full superadmin, otherwise the privilege boundary being crossed does not exist. Exploitation is further limited by a hard precondition: a UserRoleAssignment matching the targeted user and role must ALREADY exist (the endpoint returns not-found otherwise), so the attacker can only extend expires_at or clear revoked_at on pre-existing grants and cannot create net-new role assignments. Meaningful impact depends on a targeted assignment being one that was recently revoked or is set to expire. Affects Warpgate versions prior to 0.28.4 on Linux.

This is a genuine but constrained authorization flaw (CWE-862) - real, but a moderate rather than urgent priority. The vendor CVSS 4.0 vector (6.0, AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N) tells the real story: exploitation is network-reachable and low-complexity, but requires an already-authenticated limited administrator (PR:L) and, critically, an attack-requirement condition (AT:P) - a matching user/role assignment must already exist because the endpoint returns not-found for any user+role pair that has never been assigned. Impact is integrity-only (VI:H) with no confidentiality or availability effect: an attacker can only extend expires_at or clear revoked_at on a pre-existing grant, not mint arbitrary new access. Signals are consistent, not conflicting: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - the fix commit ships only a test update, not a weaponizable exploit. The main caveat is the impact metric: the vendor rated integrity High, but because the change is limited to two lifecycle fields on an existing record, an independent read leans toward Low-to-Moderate integrity unless the reinstated grant is an administrative role. Net: a defense-in-depth privilege-boundary bug affecting only environments that already delegate limited-admin roles.

An organization grants a helpdesk operator a Warpgate limited-admin role with some non-role-assignment permission. That operator sends PUT /@warpgate/admin/api/users/:id/roles/:role_id against a user whose elevated role was recently revoked (or is about to expire), clearing revoked_at or pushing out expires_at to silently reinstate/prolong that access. No public exploit code was identified; exploitation requires the target user/role assignment to already exist.