An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3

Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization

Vaultwarden: CSRF in SSO Authorization Flow

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

Vaultwarden: Refresh tokens not invalidated on security stamp rotation

Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs