What’s Vulnerable › Vulnerabilities

CVE-2025-24365: vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-27 · updated 2026-06-17
• Weakness: CWE-284

Description

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.

Affected products

• dani-garcia vaultwarden: before 1.33.0 — fixed in 1.33.0

How to fix

Upgrade to a fixed version: dani-garcia vaultwarden 1.33.0. Check the vendor advisory for mitigations.

References

• https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0
• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797

Get alerted when CVE-2025-24365 or the next vulnerability affects your stack