Hide user name on invite status #868

New Issue

MrUnknownDE · 2026-04-06T00:14:31+02:00

MrUnknownDE commented

2026-04-06 00:14:31 +02:00

Originally created by @BlackDex on 10/19/2024

A possible user disclosure when you invite an user into an organization which already has an account on the same instance. This was because we always returned the user's name. To prevent this, this PR only returns the user's name if the status is accepted or higher, else we will return null. This is the same as Bitwarden does.

Resolves a reported issue.

Also resolved a new nightly reported clippy regarding a regex within a loop.

*Originally created by @BlackDex on 10/19/2024* A possible user disclosure when you invite an user into an organization which already has an account on the same instance. This was because we always returned the user's name. To prevent this, this PR only returns the user's name if the status is accepted or higher, else we will return null. This is the same as Bitwarden does. Resolves a reported issue. Also resolved a new `nightly` reported clippy regarding a regex within a loop.

MrUnknownDE closed this issue

2026-04-06 00:14:31 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#868