Tuyen Thuc Nguyen

A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault while bypassing the necessary wait period.

An issue was discovered in Vaultwarden, which lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs, and the departing member retains a copy of the organization key. The application also fails to adequately protect some encrypted data stored on the server, allowing an authenticated user to gain unauthorized access to encrypted data of any organization, even if the user is not a member of the targeted organization, provided they know the corresponding organizationId.

A stored cross-site scripting (XSS) or HTML injection issue has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. The default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.