https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 20:05:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-207603 EUVD-2026-207603 https://cve.radiocsirt.org/vuln/euvd-2026-207603 https://cve.radiocsirt.org/vuln/fkie_cve-2024-56335 <p>vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker&#39;s account has admin or owner permissions in an unrelated organization. 3. The attacker knows the target organization&#39;s UUID and the target group&#39;s UUID. Note that this vulnerability is related to group functionality and as such is only applicable for servers who have enabled the `ORG_GROUPS_ENABLED` setting, which is disabled by default. This attack can lead to different situations: 1. Denial of service, the attacker can limit users from accessing the organization&#39;s data by removing their membership from the group. 2. Privilege escalation, if the attacker is part of the victim organization, they can escalate their own privileges by joining a group they wouldn&#39;t normally have access to. For attackers that aren&#39;t part of the organization, this shouldn&#39;t lead to any possible plain-text data exfiltration as all the data is encrypted client side. This vulnerability is patched in Vaultwarden `1.32.7`, and users are recommended to update as soon as possible. If it&#39;s not possible to update to `1.32.7`, some possible workarounds are: 1. Disabling `ORG_GROUPS_ENABLED`, which would disable groups functionality on the server. 2. Disabling `SIGNUPS_ALLOWED`, which would not allow an attacker to creat…</p> <p>vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker&#39;s account has admin or owner permissions in an unrelated organization. 3. The attacker knows the target organization&#39;s UUID and the target group&#39;s UUID. Note that this vulnerability is related to group functionality and as such is only applicable for servers who have enabled the `ORG_GROUPS_ENABLED` setting, which is disabled by default. This attack can lead to different situations: 1. Denial of service, the attacker can limit users from accessing the organization&#39;s data by removing their membership from the group. 2. Privilege escalation, if the attacker is part of the victim organization, they can escalate their own privileges by joining a group they wouldn&#39;t normally have access to. For attackers that aren&#39;t part of the organization, this shouldn&#39;t lead to any possible plain-text data exfiltration as all the data is encrypted client side. This vulnerability is patched in Vaultwarden `1.32.7`, and users are recommended to update as soon as possible. If it&#39;s not possible to update to `1.32.7`, some possible workarounds are: 1. Disabling `ORG_GROUPS_ENABLED`, which would disable groups functionality on the server. 2. Disabling `SIGNUPS_ALLOWED`, which would not allow an attacker to creat…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-56335 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3743 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Vaultwarden ausnutzen, um seine Privilegien zu erhöhen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Vaultwarden ausnutzen, um seine Privilegien zu erhöhen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3743