CVE-2024-56335: Vaultwarden Privilege Escalation Vulnerability

CVE-2024-56335 Overview

Vaultwarden is an unofficial Bitwarden-compatible server written in Rust. The application contains a broken access control flaw in its group management functionality. Authenticated attackers with admin or owner permissions in any organization can update or delete groups belonging to unrelated organizations. Exploitation requires knowledge of the target organization's UUID and the target group's UUID. The vulnerability affects only servers with the ORG_GROUPS_ENABLED setting turned on, which is disabled by default. Vaultwarden released version 1.32.7 to address this issue [CWE-269].

Critical Impact
Attackers can escalate privileges by joining restricted groups or deny service by removing users from groups within organizations they do not belong to.

Affected Products

Dani-garcia Vaultwarden versions prior to 1.32.7
Deployments with ORG_GROUPS_ENABLED set to true
Self-hosted Vaultwarden instances allowing user signups

Discovery Timeline

2024-12-20 - CVE-2024-56335 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56335

Vulnerability Analysis

The vulnerability stems from missing authorization checks in Vaultwarden's group management endpoints. The server verifies that the requesting user holds admin or owner permissions in some organization but fails to confirm that the permissions apply to the organization associated with the targeted group. An attacker with owner rights in their own organization can send update or delete requests against groups in a victim organization. The attack requires knowledge of both the target organization's UUID and the target group's UUID.

Exploitation produces two outcomes. First, attackers can remove legitimate users from groups, denying access to shared vault items and organization data. Second, attackers who are already members of the victim organization can add themselves to privileged groups, gaining access to secrets restricted by group membership. Client-side encryption prevents plaintext data exfiltration by external attackers, but internal attackers who join a privileged group can decrypt items shared with that group.

Root Cause

The root cause is improper privilege management [CWE-269]. Group modification handlers authenticate the caller and verify organization-level roles but do not tie those roles to the specific organization whose group is being modified. This scope mismatch allows cross-organization actions.

Attack Vector

The attack is network-based and requires an authenticated account on the Vaultwarden server. Servers permitting open signups (SIGNUPS_ALLOWED=true) expand the pool of potential attackers. The attacker must enumerate or obtain UUIDs for the target organization and group, which raises attack complexity but does not prevent exploitation. See the Vaultwarden GitHub Security Advisory for the technical writeup.

Detection Methods for CVE-2024-56335

Indicators of Compromise

Group modification or deletion API calls originating from user accounts not affiliated with the target organization
Unexpected group membership changes reported by organization owners or administrators
Newly created accounts on servers with SIGNUPS_ALLOWED enabled followed by rapid group API activity
Vaultwarden application logs showing group endpoint requests referencing organization UUIDs that the requesting user does not belong to

Detection Strategies

Audit Vaultwarden access logs for group management endpoints (/api/organizations/{org_id}/groups) and correlate the requesting user's organization membership against the targeted organization UUID
Enable verbose logging in Vaultwarden and forward logs to a central SIEM for cross-organization anomaly analysis
Baseline normal group modification activity per organization and alert on deviations

Monitoring Recommendations

Track all HTTP requests to Vaultwarden group management endpoints and record source account, target organization UUID, and outcome
Monitor account creation events on the Vaultwarden server, especially when SIGNUPS_ALLOWED is enabled
Alert on group membership changes that occur outside expected administrative workflows

How to Mitigate CVE-2024-56335

Immediate Actions Required

Upgrade Vaultwarden to version 1.32.7 or later
Audit existing organization groups and group memberships for unauthorized changes
Rotate any secrets stored in organization vaults if unauthorized group access is suspected
Review server signup settings and restrict SIGNUPS_ALLOWED to trusted deployments only

Patch Information

The fix is available in Vaultwarden 1.32.7. The patch enforces that the requesting user's admin or owner permissions apply to the same organization that owns the targeted group. Release details are available in the Vaultwarden GitHub Security Advisory GHSA-g65h-982x-4m5m.

Workarounds

Set ORG_GROUPS_ENABLED=false to disable the group functionality entirely if groups are not required
Set SIGNUPS_ALLOWED=false to prevent unauthenticated attackers from creating accounts on the server
Restrict Vaultwarden network exposure to trusted users through VPN or reverse proxy authentication until patching is complete

bash

# Configuration example - disable vulnerable functionality
ORG_GROUPS_ENABLED=false
SIGNUPS_ALLOWED=false