High severity8.1NVD Advisory· Published Jan 27, 2025· Updated Jun 17, 2026
CVE-2025-24365
CVE-2025-24365
Description
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*range: <1.33.0
- (no CPE)range: >=1.33.0
- (no CPE)range: < 1.33.0
Patches
Vulnerability mechanics
References
2- github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797nvdExploitVendor Advisory
- github.com/dani-garcia/vaultwarden/releases/tag/1.33.0nvdRelease Notes
News mentions
0No linked articles in our index yet.