CVE-2025-24365CWE-284

vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait

High · published January 27, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00684 · 52.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-01-27T17:49Z
EPSS history
Timeline
  • 27 JAN 17:49Z
    vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait
    cvelistv5