Compliance Impact

This vulnerability allows an attacker with administrative privileges in one organization to gain unauthorized read and write access to another organization's sensitive vault data. Such unauthorized access to confidential information can lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls on access to personal and sensitive data.

By enabling cross-organization data exposure and modification without proper authorization, the vulnerability undermines the principles of data confidentiality and integrity required by these standards.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Vaultwarden versions prior to 1.35.5. Vaultwarden does not properly verify that certain group and collection membership entries belong to the same organization. Specifically, it fails to enforce that a groups_users.users_organizations_uuid entry matches the organization of groups.groups_uuid, and similarly for collections_groups.collections_uuid and collections_groups.groups_uuid.

Because of this, an attacker who is an Admin in one organization (Organization A) but only a low-privileged member in another organization (Organization B) can exploit this flaw. They can bind their membership UUID from Organization B into a group in Organization A, thereby gaining unauthorized access to Organization B's vault data through Organization A's group.

With an accessAll=true group in Organization A, the attacker can use API endpoints like /api/sync and /api/ciphers to enumerate and access Organization B's cipher data. After discovering Organization B's collection IDs, the attacker can also bind those foreign collection IDs to the Organization A group, escalating their access to write permissions over Organization B's items.

This vulnerability was fixed in Vaultwarden version 1.35.5.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access and modification of sensitive data stored in Vaultwarden vaults across different organizations.

• An attacker with admin rights in one organization can gain unauthorized read access to vault data in another organization where they have low privileges.
• The attacker can enumerate sensitive cipher data and collection IDs belonging to another organization.
• The attacker can escalate privileges to write access on another organization's vault items by exploiting the binding flaw.

Overall, this can lead to data breaches, loss of confidentiality, and unauthorized data manipulation.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Vaultwarden version 1.35.5. The immediate step to mitigate this vulnerability is to upgrade Vaultwarden to version 1.35.5 or later.

Useful 0 Not Useful 0