UpHeron
All vulnerabilities

Servers and applications

CVE-2024-56335

Privilege escalation allows organization groups to be updated/deleted if their UUID is known

Severity
High 7.5
Published
20 Dec 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.32.6, 1.32.7
Also known as
GHSA-g65h-982x-4m5m
Sources
NVD, Project advisories (GitHub)

Description

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker's account has admin or owner permissions in an unrelated organization. 3. The attacker knows the target…

Affected software

SoftwareAffected versions
VaultwardenServers and applications · cpe:a:dani-garcia:vaultwarden
  • Every version before 1.32.7
VaultwardenServers and applications · github:dani-garcia/vaultwarden
  • Every version before 1.32.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-56335
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-56335
  • GitHub Advisory Database https://github.com/advisories/GHSA-g65h-982x-4m5m
  • github.com https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-g65h-982x-4m5m