title: Lock WARP switch bypass on WARP mobile client using iOS quick action
description: Lock Warp switch is a feature of Zero Trust platform which, when
enabled, prevents users of enrolled devices from disabling WARP client.
Due to insufficient policy verification by WARP iOS client, this
feature could be bypassed by using the "Disable WARP" quick action.
problem types: CWE-862 Missing Authorization
affected:
{
defaultStatus: unaffected
platforms: iOS
product: WARP
vendor: Cloudflare
versions:
lessThan: 6.14, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Upgrade to the specified patched version.