Description
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dani-garcia | vaultwarden | < 1.33.0 | — |
Advisories 1
- WID-SEC-2025-0191 Vaultwarden: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 30, 2025