Vaultwarden Access Control Bypass via Membership Validation Failure

Vaultwarden versions 1.37.3 and earlier contain a critical vulnerability in the organization access control logic. The application fails to properly enforce membership status checks within key cipher access-restriction functions, specifically get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group. As a result, users who have been revoked from an organization or users whose membership is currently in a pending state retain their ability to perform read, write, and delete operations on organization-managed ciphers, as well as interact with associated attachments. This flaw allows unauthorized individuals to access or modify protected credentials beyond their intended privilege level. Defenders should prioritize updating to the latest patched version to ensure proper access control enforcement.

Impact

Successful exploitation allows unauthorized users to access, modify, or delete organization-wide secrets and attachments. This could lead to massive credential exposure within enterprise Vaultwarden deployments, effectively granting revoked or unvetted users complete control over corporate secrets.

Recommendation

• Upgrade all Vaultwarden instances to a version later than 1.37.3 immediately.
• Review organization audit logs for access activity by users with revoked or pending statuses.
• Ensure all service accounts and API clients utilizing the Vaultwarden API are patched and audited for abnormal cipher access patterns.