CVE-2026-63330

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.6

Description The api get recording stream function in warpgate-admin/src/api/recordings detail.rs fails to enforce the AdminPermission::RecordingsView requirement for the '/@warpgate/admin/api/recordings/{uuid}/stream' endpoint, relying only on session authentication. This allows any authenticated regular user who knows the uuid of an active recording to subscribe to its WebSocket and view real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, potentially exposing credentials and sensitive data.

Recommendations Update to version 0.25.6.