vaultwarden

vaultnord.no/vaultwarden

0 Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-10-27 08:30:13 +00:00

Files

T

History

Abhi ShandilyaandDaniel García d2660324e6 Fix revoked org members retaining access to org ciphers (#7554 )

The cipher access restriction queries (direct collection access, group
collection access, and full access via groups) never checked the
organization membership status. Since users_collections and groups_users
rows are kept when a membership is revoked, revoked (and not yet
confirmed) members kept read, write, delete, attachment and
collection-move access to org ciphers via the direct-by-UUID endpoints.

Require a confirmed membership in the cipher's organization in all
three queries, matching the behavior of the sync queries.

Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>

2026-09-23 19:44:05 +02:00

api

set user_created bool for each separate invitation (#7753 )

2026-09-18 20:35:11 +02:00

auth

Trusted proxy support, unauthenticated rate limit & other fixes (#7472 )

2026-07-24 18:27:32 +02:00

Fix revoked org members retaining access to org ciphers (#7554 )

2026-09-23 19:44:05 +02:00

static

Update Crates, GHA and JS (#7751 )

2026-09-18 18:44:50 +02:00