(This is a maintainer found security issue)

Summary

An attacker is capable of updating or deleting groups from an organization given a few conditions:

• The attacker has a user account in the server.
• The attacker's account has admin or owner permissions in an unrelated organization.
• The attacker knows the target organization's UUID and the target group's UUID.

Note that this vulnerability is related to group functionality and as such is only applicable for servers who have enabled the ORG_GROUPS_ENABLED setting, which is disabled by default.

This attack can lead to different situations:

• Denial of service, the attacker can limit users from accessing the organization's data by removing their membership from the group.
• Privilege escalation, if the attacker is part of the victim organization, they can escalate their own privileges by joining a group they wouldn't normally have access to.

For attackers that aren't part of the organization, this shouldn't lead to any possible plain-text data exfiltration as all the data is encrypted client side.

Patches

This vulnerability is patched in Vaultwarden 1.32.7, and users are recommended to update as soon as possible.

Workarounds

If it's not possible to update to 1.32.7, some possible workarounds are:

• Disabling ORG_GROUPS_ENABLED, which would disable groups functionality on the server.
• Disabling SIGNUPS_ALLOWED, which would not allow an attacker to create new accounts on the server.