Removeing user from an org removes access to all collections, even from other orgs #2738

New Issue

MrUnknownDE · 2026-04-06T04:00:02+02:00

MrUnknownDE commented

2026-04-06 04:00:02 +02:00

Originally created by @BlackDex on 10/29/2020

Subject of the issue

When a user only has access to specific collections at multiple organizations, and you remove that user from one of these organizations, they will lose access to all collections.

Your environment

Bitwarden_rs version: 1.17.0 (master)
Install method: cargo build
Clients used: web-vault
Reverse proxy and version: haproxy
Version of mysql/postgresql: sqlite3
Other relevant information:

Steps to reproduce

Create 2 or 3 Orgs
Invite a user to all these orgs and only give that user access to a specific collection (Default one)
Verify that user so he has access to all these items
Verify that the new users can see all the orgs/collections and passwords within.
Now remove that same user from one of these organizations
Refresh that users environment and see all org/collections are gone.

Expected behaviour

To be only removed from the specific collection linked to the organization where the user was removed from.

Actual behaviour

Access removed from all organizations.

Relevant logs

n/a

*Originally created by @BlackDex on 10/29/2020* ### Subject of the issue When a user only has access to specific collections at multiple organizations, and you remove that user from one of these organizations, they will lose access to all collections. ### Your environment * Bitwarden_rs version: 1.17.0 (master) * Install method: cargo build * Clients used: web-vault * Reverse proxy and version: haproxy * Version of mysql/postgresql: sqlite3 * Other relevant information: ### Steps to reproduce 1. Create 2 or 3 Orgs 2. Invite a user to all these orgs and only give that user access to a specific collection (Default one) 3. Verify that user so he has access to all these items 4. Verify that the new users can see all the orgs/collections and passwords within. 5. Now remove that same user from one of these organizations 6. Refresh that users environment and see all org/collections are gone. ### Expected behaviour To be only removed from the specific collection linked to the organization where the user was removed from. ### Actual behaviour Access removed from all organizations. ### Relevant logs n/a

MrUnknownDE closed this issue

2026-04-06 04:00:02 +02:00

Sign in to join this conversation.

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#2738