Some refactoring, optimizations and security fixes #799

New Issue

MrUnknownDE · 2026-04-05T23:36:28+02:00

MrUnknownDE commented

2026-04-05 23:36:28 +02:00

Originally created by @BlackDex on 12/13/2024

Refactored several code to use more modern syntax
Made some checks a bit more strict
Updated crates

We also fixed a security issue with groups. Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid. The organization uuid was not used in the query or validated with the group. This is now fixed including some other parts where i changed the checks to be more strict.

*Originally created by @BlackDex on 12/13/2024* - Refactored several code to use more modern syntax - Made some checks a bit more strict - Updated crates We also fixed a security issue with groups. Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid. The organization uuid was not used in the query or validated with the group. This is now fixed including some other parts where i changed the checks to be more strict.

MrUnknownDE closed this issue

2026-04-05 23:36:28 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#799