CVE-2025-24365

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0	Release Notes
https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-01-27 18:15

Updated : 2025-08-20 13:56

NVD link : CVE-2025-24365

Mitre link : CVE-2025-24365

CVE.ORG link : CVE-2025-24365

JSON object : View

Products Affected

dani-garcia

vaultwarden

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2025-24365", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2025-01-27T18:15:41.847", "references": [{"url": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0."}, {"lang": "es", "value": "vaultwarden es un servidor no oficial compatible con Bitwarden escrito en Rust, anteriormente conocido como bitwarden_rs. El atacante puede obtener derechos de propietario de otra organizaci\u00f3n. El hacker debe conocer el ID de la organizaci\u00f3n v\u00edctima (en el caso real, el usuario puede ser parte de la organizaci\u00f3n como un usuario sin privilegios) y ser el propietario/administrador de otra organizaci\u00f3n (de manera predeterminada, puede crear su propia organizaci\u00f3n) para poder atacar. Esta vulnerabilidad se corrigi\u00f3 en 1.33.0."}], "lastModified": "2025-08-20T13:56:46.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40E93323-3FC8-4B26-8940-BFA0F1436F79", "versionEndExcluding": "1.33.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}