Summary
Vaultwarden fails to validate organization membership status in several cipher access-control queries. As a result, revoked or not-yet-confirmed members may retain server-side read, write, delete, and attachment access to organization ciphers.
Affected context
The issue occurs in Vaultwarden organization cipher authorization logic when access decisions rely on collection permissions or full-access group membership without also confirming the member's current organization status. Deployments are at risk when a user has been revoked or remains pending while previously associated access paths continue to be evaluated.
Exploit preconditions
- Attack surface: Vaultwarden server-side organization cipher and attachment access endpoints
- Required access: An account associated with the organization as a revoked or not-yet-confirmed member
- Trigger point: Authorization checks involving collection access flags or full-access group membership
- Why exploitation is possible: Relevant queries omit membership-status restrictions, allowing stale or incomplete membership relationships to satisfy access checks
Why this happens
The underlying bug is an authorization decision made from incomplete access-control state. The affected queries evaluate collection or group permissions but do not consistently require an active, confirmed organization membership status before granting cipher-related operations. This maps to CWE-863: Incorrect Authorization, because the server may authorize a protected action for a user who no longer satisfies the intended authorization policy.
Potential impact
- Revoked members may retain access to organization cipher data
- Pending members may access ciphers before membership confirmation
- Attackers could read or modify protected cipher records
- Cipher deletion or attachment access could occur without current authorization
- Confidential organization secrets may be exposed or disrupted
General mitigation guidance
Mitigation generally focuses on making authorization decisions depend on complete and current membership state.
Common defensive patterns include:
- Require active and confirmed organization membership in every relevant access query
- Centralize authorization checks so cipher, collection, group, and attachment operations share consistent policy logic
- Treat revocation and pending status as immediate access-denial states
- Re-evaluate membership status server-side for every protected operation rather than relying on cached client state
- Apply least-privilege defaults and deny access when membership or permission data is incomplete
- Add regression tests covering revoked, pending, removed, and active membership states
How teams detect issues like this
Organizations can assess for this class of issue through:
- Static analysis and code review for authorization queries that omit membership-status predicates
- Review of all cipher and attachment handlers for consistent active-membership enforcement
- Tests that compare access decisions before and after revocation or confirmation changes
- Policy checks requiring centralized authorization functions for organization resources
- Audit-log monitoring for cipher access or mutation after membership revocation
- Automated security review tools that identify permission checks based on incomplete identity or relationship state
