CVE-2025-24365: Vaultwarden Privilege Escalation Flaw

CVE-2025-24365 Overview

CVE-2025-24365 is a broken access control vulnerability in Vaultwarden, an unofficial Bitwarden-compatible password manager server written in Rust. The flaw allows an authenticated attacker to obtain owner rights over another organization in the same Vaultwarden instance. To exploit the issue, the attacker must know the target organization's identifier and hold owner or admin privileges in any organization they control. Since Vaultwarden allows users to create their own organizations by default, this prerequisite is trivial to satisfy. The vulnerability is tracked under [CWE-284: Improper Access Control] and is fixed in Vaultwarden version 1.33.0.

Critical Impact
A low-privileged user can escalate to owner of an arbitrary target organization, exposing all stored credentials, secrets, and shared vault items.

Affected Products

Vaultwarden versions prior to 1.33.0
dani-garcia/vaultwarden self-hosted deployments
Container images derived from vulnerable upstream releases

Discovery Timeline

2025-01-27 - CVE-2025-24365 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24365

Vulnerability Analysis

Vaultwarden implements the Bitwarden API surface, including endpoints for managing organizations, collections, and member roles. The vulnerable code path fails to verify that the authenticated requester is a legitimate owner or admin of the organization referenced in the request. Instead, it accepts the organization identifier supplied by the client and applies privileged operations against it.

An attacker who is an unprivileged member of a target organization can read its identifier from normal API responses. Combined with owner privileges on a separately created organization, the attacker can craft requests that pivot owner-level actions onto the target organization. The result is a horizontal-to-vertical privilege escalation that yields full control of organizational vault data.

The vulnerability affects the confidentiality, integrity, and availability of stored secrets. An owner can view all collections, add or remove members, rotate keys, and delete the organization outright.

Root Cause

The root cause is missing server-side authorization checks on organization-scoped endpoints. The handler trusts the organization ID supplied in the request body or URL path without binding it to the membership and role of the authenticated session. This pattern maps to [CWE-284: Improper Access Control].

Attack Vector

Exploitation occurs over the network against the Vaultwarden HTTP API. The attacker authenticates with valid credentials, creates or uses an existing organization where they hold owner or admin rights, and issues authenticated requests targeting the victim organization's ID. No user interaction from the victim is required.

The vulnerability mechanism is described in the upstream advisory. Refer to the GitHub Security Advisory GHSA-j4h8-vch3-f797 for the official technical disclosure.

Detection Methods for CVE-2025-24365

Indicators of Compromise

Unexpected changes to organization ownership or admin membership in Vaultwarden audit logs
API requests where the authenticated user is not a known member of the organization ID referenced in the request body
Sudden creation of new organizations followed by privileged actions against unrelated organization IDs
Mass export or download of collections shortly after membership changes

Detection Strategies

Review Vaultwarden application logs for organization role modifications (PUT/POST to /api/organizations/{id}/users/*) correlated to non-member accounts
Compare the user_uuid issuing privileged organization calls against the membership table to flag mismatches
Monitor reverse proxy access logs for high-frequency enumeration of organization UUIDs by a single authenticated session

Monitoring Recommendations

Forward Vaultwarden container and database audit logs to a centralized SIEM for retention and correlation
Alert on any administrative role assignment originating from a user that joined the organization within the last 24 hours
Track baseline organization counts and trigger alerts when a single account creates multiple organizations in a short window

How to Mitigate CVE-2025-24365

Immediate Actions Required

Upgrade all Vaultwarden instances to version 1.33.0 or later without delay
Audit organization membership and ownership records for unauthorized changes since deployment
Rotate sensitive secrets stored in any organization vault that may have been exposed
Restrict registration and organization creation to trusted users while patching is in progress

Patch Information

The maintainers fixed CVE-2025-24365 in Vaultwarden 1.33.0. The release adds the missing authorization checks on organization-scoped endpoints. Container operators should pull the updated image, redeploy, and verify the running version through the admin panel.

Workarounds

Disable open user signups by setting SIGNUPS_ALLOWED=false to reduce the pool of accounts able to attempt exploitation
Set ORG_CREATION_USERS to a restricted allowlist so that arbitrary users cannot create the prerequisite attacker-controlled organization
Place Vaultwarden behind an authenticating reverse proxy or VPN to limit network exposure until the patch is applied

bash

# Configuration example: restrict signups and organization creation
# /etc/vaultwarden/vaultwarden.env
SIGNUPS_ALLOWED=false
INVITATIONS_ALLOWED=true
ORG_CREATION_USERS=admin@example.com
# After updating env vars, redeploy with the patched image:
docker pull vaultwarden/server:1.33.0
docker compose up -d vaultwarden