Vaultwarden, a Bitwarden-compatible server written in Rust, has an incorrect authorization vulnerability (CWE-863) in versions before 1.35.5. The organization invite process involves two membership states: Invited to Accepted, then Accepted to Confirmed by an existing owner. The POST /api/ciphers/purge endpoint checks only for membership type Owner but fails to verify the Confirmed status. This allows an authenticated user with Accepted but unconfirmed owner status to hard-delete all organization vault data. The vulnerability is addressed in Vaultwarden 1.35.5.

Exploitation allows an authenticated but unconfirmed organization owner to irreversibly delete all ciphers and attachments in the organization vault, resulting in immediate and total data loss for the organization. There is no indication of confidentiality or availability impact beyond data deletion. No known exploits in the wild have been reported.

This vulnerability is fixed in Vaultwarden version 1.35.5. Users should upgrade to version 1.35.5 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be included in 1.35.5. Until upgraded, restrict organization owner invitations and monitor for suspicious activity related to organization vault purging.