Vaultwarden, a Bitwarden-compatible server, prior to version 1.35.5, fails to enforce organizational consistency checks on group and collection membership entries. Specifically, it does not verify that entries in groups_users.users_organizations_uuid correspond to the same organization as groups.groups_uuid, nor that collections_groups.collections_uuid correspond to collections_groups.groups_uuid. This allows an attacker who is an admin in Organization A and a low-privileged member in Organization B to bind their Organization B membership UUID into an Organization A group. By exploiting this, the attacker can enumerate and access Organization B's vault data through Organization A's group relationships, including reading and writing vault items. The vulnerability is fixed in Vaultwarden 1.35.5.

An attacker with admin privileges in one organization and low privileges in another can bypass authorization controls to gain unauthorized read and write access to vault data in the second organization. This leads to a confidentiality and integrity breach of sensitive vault information across organizational boundaries. The CVSS score of 8.7 reflects the high impact on confidentiality and integrity, with no impact on availability.

This vulnerability is fixed in Vaultwarden version 1.35.5. Users should upgrade to version 1.35.5 or later to remediate this issue. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix is included in version 1.35.5.