Custom User role not able to delete collection for which assigned manage permission #434

New Issue

MrUnknownDE · 2026-04-05T21:14:07+02:00

MrUnknownDE commented

2026-04-05 21:14:07 +02:00

Originally created by @jpVm5jYYRE1VIKL on 8/6/2025

Prerequisites

I have searched the existing Closed AND Open Issues AND Discussions
I have searched and read the documentation

Vaultwarden Support String

issue not related to any crashes and do not require any trace

Vaultwarden Build Version

1.34.1

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

nginx

Host/Server Operating System

Linux

Operating System Version

No response

Clients

Web Vault

Client Version

No response

Steps To Reproduce

Well let say that exist user which have custom permission to manage some collections .
But in reality such user not able to delete collection for which he is manager.
Organisation link even not appear in user web ui.
If to assign for user permission to be able to manage all collecion then organisation link appear in users web ui but user also able to manege and delete any collection in organisation which it extremely huge security problem.

Create organisation
create some collections : collection1 , collection2, collection3
create user with custom permission role
assign for user permission to be manager of one of collections
Login as user to web ui
you not able to do any management of collection because not exist link to Admin Console for such user

Expected Result

User must be able to manage collection where he assigned to be manager and must be able to delete collation for which he is manager.

Actual Result

User cannot do anything with collection except adding password or delete passwords.

Logs

Screenshots or Videos

No response

Additional Context

No response

*Originally created by @jpVm5jYYRE1VIKL on 8/6/2025* ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String issue not related to any crashes and do not require any trace ### Vaultwarden Build Version 1.34.1 ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy nginx ### Host/Server Operating System Linux ### Operating System Version _No response_ ### Clients Web Vault ### Client Version _No response_ ### Steps To Reproduce Well let say that exist user which have custom permission to manage some collections . But in reality such user not able to delete collection for which he is manager. Organisation link even not appear in user web ui. If to assign for user permission to be able to manage all collecion then organisation link appear in users web ui but user also able to manege and delete any collection in organisation which it extremely huge security problem. 1. Create organisation 2. create some collections : collection1 , collection2, collection3 3. create user with custom permission role 4. assign for user permission to be manager of one of collections 5. Login as user to web ui 6. you not able to do any management of collection because not exist link to Admin Console for such user ### Expected Result User must be able to manage collection where he assigned to be manager and must be able to delete collation for which he is manager. ### Actual Result User cannot do anything with collection except adding password or delete passwords. ### Logs ```text ``` ### Screenshots or Videos _No response_ ### Additional Context _No response_

MrUnknownDE closed this issue

2026-04-05 21:14:07 +02:00

Sign in to join this conversation.

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#434