vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attackers account has admin or owner permissions in an unrelated organization. 3. The attacker knows the target organizations UUID and the target groups UUID. Note that this vulnerability is related to group functionality and as such is only applicable for servers who have enabled the ORG_GROUPS_ENABLED setting, which is disabled by default. This attack can lead to different situations: 1. Denial of service, the attacker can limit users from accessing the organizations data by removing their membership from the group. 2. Privilege escalation, if the attacker is part of the victim organization, they can escalate their own privileges by joining a group they wouldnt normally have access to. For attackers that arent part of the organization, this shouldnt lead to any possible plain-text data exfiltration as all the data is encrypted client side. This vulnerability is patched in Vaultwarden 1.32.7, and users are recommended to update as soon as possible. If its not possible to update to 1.32.7, some possible workarounds are: 1. Disabling ORG_GROUPS_ENABLED, which would disable groups functionality on the server. 2. Disabling SIGNUPS_ALLOWED, which would not allow an attacker to create new accounts on the server.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.