UpHeron
All vulnerabilities

Servers and applications

CVE-2025-24365

Escalation of privilege via variable confusion in OrgHeaders trait

Severity
High 7.5
Published
25 Jan 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.33.0
Also known as
GHSA-j4h8-vch3-f797
Sources
NVD, Project advisories (GitHub)

Description

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order…

Affected software

SoftwareAffected versions
VaultwardenServers and applications · cpe:a:dani-garcia:vaultwarden
  • Every version before 1.33.0
VaultwardenServers and applications · github:dani-garcia/vaultwarden
  • Every version before 1.33.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-24365
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-24365
  • GitHub Advisory Database https://github.com/advisories/GHSA-j4h8-vch3-f797
  • github.com https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797