Executive Summary

This vulnerability exists in Vaultwarden versions prior to 1.35.5. Vaultwarden is a Bitwarden-compatible server written in Rust. The issue arises because an unconfirmed organization owner—someone who has accepted an invite to join an organization but has not yet been confirmed by an existing owner—can purge the entire organization vault.

The organization invite process involves two steps: first, a user accepts an invite, changing their membership status from Invited to Accepted; second, an existing owner confirms the user, upgrading their status to Confirmed. However, the POST /api/ciphers/purge endpoint only checks if the user is an Owner but does not verify if their membership status is Confirmed.

As a result, an authenticated user who is an unconfirmed owner can call this endpoint to hard-delete all ciphers and attachments in the organization, causing immediate and complete data loss for the organization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to immediate and total loss of all encrypted data (ciphers and attachments) stored within an organization's Vaultwarden vault. An unconfirmed organization owner with malicious intent or compromised credentials could exploit this flaw to delete all sensitive information, causing significant disruption and data loss.

The impact includes loss of critical passwords, secrets, and attachments managed by the organization, potentially affecting business operations, security posture, and trust.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Vaultwarden version 1.35.5. To mitigate this vulnerability, you should immediately upgrade your Vaultwarden server to version 1.35.5 or later.

This update ensures that the POST /api/ciphers/purge endpoint verifies that the organization owner's membership status is Confirmed before allowing the purge operation, preventing unconfirmed owners from deleting all organization data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unconfirmed organization owner to purge the entire organization vault, causing immediate organization-wide data loss.

Such unauthorized data deletion could impact compliance with data protection regulations like GDPR and HIPAA, which require organizations to ensure the integrity and availability of sensitive data.

However, the provided information does not explicitly discuss compliance implications or how this vulnerability affects adherence to these standards.

Useful 0 Not Useful 0