hacktoberfestdockervaultwardenrustrocketbitwarden-rsbitwarden

You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Tree: b571efcadd

cached-config-operations

main

revert-7033-patch-1

test_dylint

0.10.0

0.11.0

0.12.0

0.13.0

0.9.0

1.0.0

1.1.0

1.10.0

1.11.0

1.12.0

1.13.0

1.13.1

1.14

1.14.1

1.14.2

1.15.0

1.15.1

1.16.0

1.16.1

1.16.2

1.16.3

1.17.0

1.18.0

1.19.0

1.2.0

1.20.0

1.21.0

1.22.0

1.22.1

1.22.2

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.25.2

1.26.0

1.27.0

1.28.0

1.28.1

1.29.0

1.29.1

1.29.2

1.3.0

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.32.0

1.32.1

1.32.2

1.32.3

1.32.4

1.32.5

1.32.6

1.32.7

1.33.0

1.33.1

1.33.2

1.34.0

1.34.1

1.34.2

1.34.3

1.35.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.5

1.35.6

1.35.7

1.35.8

1.36.0

1.37.0

1.4.0

1.5.0

1.6.0

1.6.1

1.7.0

1.8.0

1.9.0

1.9.1

Branches Tags

${ item.name }

Create tag ${ searchTerm }

Create branch ${ searchTerm }

from 'b571efcadd'

${ noResults }

vaultwarden/src

History

tom27052006 8a65c6631a Security: gate group delete/member-removal on collection access A Custom member with only the manage_groups permission could revoke other members' collection access via two endpoints that were missing the collection-access check enforced elsewhere (put_group_members, edit_member): - POST /organizations/<org>/groups/<group>/delete-user/<member> (post_delete_group_member) removed a member from any group, including collection-bearing ones. - DELETE /organizations/<org>/groups/<group> and its bulk variant (delete_group_impl / bulk_delete_groups) deleted collection-bearing groups outright, revoking access for all their members. Neither path can grant access, so confidentiality was never at risk, but both let a manage_groups-only user tamper with other members' collection access, contradicting the permission's invariant. Both now require Admin/Owner or full collection access before touching a group that confers collection access (via access_all or assigned collections).		2 weeks ago
..
api	Security: gate group delete/member-removal on collection access	2 weeks ago
auth	2026.6.0 send support (#7346)	2 weeks ago
db	Merge remote-tracking branch 'upstream/main' into feature/custom-role-permissions	2 weeks ago
static	Add custom role permissions: Manage Users, Groups, Policies	3 weeks ago
auth.rs	Merge remote-tracking branch 'upstream/main' into feature/custom-role-permissions	2 weeks ago
config.rs	Add `pm-26340-linux-biometrics-v2` feature flag (#7358)	2 weeks ago
crypto.rs	Several SSO Fixes (#7163)	3 months ago
error.rs	2026.6.0 send support (#7346)	2 weeks ago
http_client.rs	Fix enforce blocked (#7246)	2 weeks ago
mail.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago
main.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago
ratelimit.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago
sso.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago
sso_client.rs	SSO use ClientSecretPost if ClientSecretBasic is not available (#7357)	2 weeks ago
storage.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago
util.rs	Switch to Edition 2024, more clippy lints, and less macro calls (#7200)	2 months ago