CVE-2026-43913— Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization, causing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

授权机制不正确

Vaultwarden 安全漏洞

Vaultwarden是Daniel García个人开发者的一个用 Rust 编写的 Bitwarden 服务器 API 的替代实现。 Vaultwarden 1.35.5之前版本存在安全漏洞，该漏洞源于允许未确认的组织所有者清除整个组织保险库，组织邀请流程使用两步过程，POST /api/ciphers/purge端点仅检查成员类型为所有者而不验证成员状态为已确认，已受邀为组织所有者并已接受邀请但尚未被确认的认证用户可调用此端点硬删除组织中的所有密码和附件，导致立即的组织范围数据丢失。

N/A

N/A