Some fixes for emergency access #1061

New Issue

MrUnknownDE · 2026-04-06T01:34:12+02:00

MrUnknownDE commented

2026-04-06 01:34:12 +02:00

Originally created by @BlackDex on 7/8/2024

Add missing Headers parameter for some functions This allowed any request from allowing these endpoints by not validating the user correctly.
Changed the functions to retreive the emergency access record by using the user uuid which calls the endpoint, instead of validating afterwards. This is more secure and prevents the need of an if check.

Fixes https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39924

*Originally created by @BlackDex on 7/8/2024* - Add missing `Headers` parameter for some functions This allowed any request from allowing these endpoints by not validating the user correctly. - Changed the functions to retreive the emergency access record by using the user uuid which calls the endpoint, instead of validating afterwards. This is more secure and prevents the need of an if check. Fixes https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39924

MrUnknownDE closed this issue

2026-04-06 01:34:12 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#1061