Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
dani-garcia/vaultwarden
main @ d6a3d53
155
Fixes
20
CVEs
CRITICAL
Peak severity
41.7%
Coverage
Highlights
Auth Bypass: 103 prior fixes. Scrutinize any change in this area.
src/api/core/organizations.rs: most-fixed (35 issues). Treat as high-risk during review.
81 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: A critical logical flaw in validating authorization requests allowed attackers to impersonate arbitrary users, including administrators, by supplying manipulated fields in login payloads. This was fixed by enforcing strict, immediate deletion of requests and validating the client context against authenticated headers.
Broken Access Control: Inadequate multi-tenant tenant-isolation boundaries allowed organization administrators or owners to edit or delete memberships, retrieve private keys, or modify group configurations belonging to unrelated organizations because database queries failed to restrict user lookups to both user and organization identifiers.
Auth Bypass: A recurring pattern of authorization bypasses stemmed from endpoints and request guards failing to verify that organization members are fully in a 'Confirmed' status, allowing unconfirmed users to read or delete sensitive vault ciphers and collections.