Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In the test environment, it was confirmed that an authenticated regular user can specify another user’s cipherid and call: Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). Description putcipherpartial retrieves the target Cipher but does not perform ownership or access control checks before returning tojson. Authorization checks present in the normal update API are missing here. src/api/core/ciphers.rs:717 By comparison, the standard update API includes an explicit authorization check: src/api/core/ciphers.rs:688 The tojson method does not abort processing when access restrictions are not met; instead, it proceeds to construct and return a detailed response. src/db/models/cipher.rs:175 src/db/models/cipher.rs:335 Preconditions The attacker possesses a valid regular-user JWT (Bearer token). The attacker knows the target (victim)…
Recommended action: Upgrade to 1.35.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Testing confirmed that even when a Manager has manage=false for a given collection, they can still perform the following management operations as long as they have access to the collection: PUT /api/organizations/<orgid/collections/<colid succeeds (HTTP 200) PUT /api/organizations/<orgid/collections/<colid/users succeeds (HTTP 200) DELETE /api/organizations/<orgid/collections/<colid succeeds (HTTP 200) Description The Manager guard checks only whether the user can access the collection, not whether they have manage privileges. This check is directly applied to management endpoints. src/auth.rs:816 The canaccesscollection function does not evaluate the manage flag. src/db/models/collection.rs:140 A separate management-permission check exists and includes manage validation, but it is not used during authorization for the affected endpoints. src/db/models/collection.rs:516 The actual update and deletion endpoints only accept ManagerHeaders and do not perform additional manage…
Recommended action: Upgrade to 1.35.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Manager account (accessall=false) was able to escalate privileges by directly invoking the bulk-access API against collections that were not originally assigned to them. The API allowed changing assigned=false to assigned=true, resulting in unauthorized access. Additionally, prior to the bulk-access call, the regular single-update API correctly returned 401 Unauthorized for the same collection. After executing the bulk-access API, the same update API returned 200 OK, confirming an authorization gap at the HTTP level. --- Description The endpoint accepts ManagerHeadersLoose and does not validate access rights for the specified collectionIds. src/api/core/organizations.rs:551 The received collectionids are processed directly without per-collection authorization checks. src/api/core/organizations.rs:564 Existing group assignments for the collection are deleted. src/api/core/organizations.rs:583 Existing user assignments for the collection are deleted.…
Recommended action: Upgrade to 1.35.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vaultwarden v1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass to perform protected actions such as accessing the user's API key or deleting the user's vault and organisations the user is an admin/owner of. Note that Details Within Vaultwarden, the PasswordOrOtpData struct is used to gate certain protected actions such as account deletion behind a 2FA validation. This validation requires the user to either re-enter their master password, or to enter a one-time passcode sent to their email address. By default, the one-time passcode is comprised of six digits, and the expiry time for each token is ten minutes. The validation of this one-time passcode is performed by the following function: Since the one-time passcode is only six-digits long, it has significantly less entropy than a typical password or secret key. Hence, Vaultwarden attempts to prevent…
Recommended action: Upgrade to 1.35.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
Recommended action: Upgrade to 1.32.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
Recommended action: Upgrade to 1.32.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.
Recommended action: Upgrade to 1.32.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.