Mirko Richter

The issue allows for denial of service, causing an interface error in the Bookmark Toolbar, which can be exploited by an administrator-level backend user account through manipulated data saved in the bookmark toolbar of the backend user interface. This is due to insufficient input validation, leading to a general error state that blocks further access to the interface.

A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault while bypassing the necessary wait period.

An issue was discovered in Vaultwarden, which lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs, and the departing member retains a copy of the organization key. The application also fails to adequately protect some encrypted data stored on the server, allowing an authenticated user to gain unauthorized access to encrypted data of any organization, even if the user is not a member of the targeted organization, provided they know the corresponding organizationId.

A stored cross-site scripting (XSS) or HTML injection issue has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. The default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.