Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. This issue has been patched in version 1.35.4.

Affected: crates.io: vaultwarden

## Summary

A Manager account (`access_all=false`) was able to escalate privileges by directly invoking the **bulk-access API** against collections that were not originally assigned to them. The API allowed changing `assigned=false` to `assigned=true`, resulting in unauthorized access.

Additionally, prior to the bulk-access call, the regular single-update API correctly returned **401 Unauthorized** for the same collection. After executing the bulk-access API, the same update API returned **200 OK**, confirming an authorization gap at the HTTP level.

---

## Description

* The endpoint accepts `ManagerHeadersLoose` and does not validate access rights for the specified `collectionIds`. src/api/core/organizations.rs:551

```rust headers: ManagerHeadersLoose, ```

* The received `collection_ids` are processed directly without per-collection authorization checks. src/api/core/organizations.rs:564

```rust for col_id in data.collection_ids { ```

* Existing group assignments for the collection are deleted. src/api/core/organizations.rs:583

```rust CollectionGroup::delete_all_by_collection(&col_id, &conn).await?; ```

* Existing user assignments for the collection are deleted. src/api/core/organizations.rs:590

```rust CollectionUser::delete_all_by_collection(&col_id, &conn).await?; ```

* By comparison, another bulk-processing endpoint performs per-collection validation using `from_loose`. src/api/core/organizations.rs:787

```rust let head…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Privilegien zu erlangen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.