Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

Affected: crates.io: vaultwarden

## Summary

Testing confirmed that even when a Manager has `manage=false` for a given collection, they can still perform the following management operations as long as they have access to the collection:

* `PUT /api/organizations/<org_id>/collections/<col_id>` succeeds (HTTP 200) * `PUT /api/organizations/<org_id>/collections/<col_id>/users` succeeds (HTTP 200) * `DELETE /api/organizations/<org_id>/collections/<col_id>` succeeds (HTTP 200)

## Description

* The Manager guard checks only whether the user **can access the collection**, not whether they have `manage` privileges. This check is directly applied to management endpoints. src/auth.rs:816 ```rust

if !Collection::can_access_collection(&headers.membership, &col_id, &conn).await { err_handler!("The current user isn't a manager for this collection") } ```

* The `can_access_collection` function does **not** evaluate the `manage` flag. src/db/models/collection.rs:140

```rust

pub async fn can_access_collection(member: &Membership, col_id: &CollectionId, conn: &DbConn) -> bool { member.has_status(MembershipStatus::Confirmed) && (member.has_full_access() || CollectionUser::has_access_to_collection_by_user(col_id, &member.user_uuid, conn).await || ... ```

* A separate management-permission check exists and includes `manage` validation, but it is **not used** during authorization for the affected endpoints. src/db/models/collection.rs:516

```rust…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Privilegien zu erlangen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.