Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

Vaultwarden before v1.32.5 allows attackers to impersonate administrators

CVE-2024-55225 · published 1 year ago
Summary

A security issue in Vaultwarden's authorization system allows attackers to pretend to be administrators, potentially giving them full control over the system. This affects all versions of Vaultwarden prior to 1.32.5. Update to 1.32.5 or later to protect your system.

What to do
  • Update dani-garcia vaultwarden to version 1.32.5.
Affected software
Ecosystem VendorProductAffected versions
rust dani-garcia vaultwarden < 1.32.5
Fix: upgrade to 1.32.5
– dani-garcia vaultwarden < 1.32.5
cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*
Original advisory text
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-276Incorrect Default Permissions
CWE-863Incorrect Authorization
Timeline
Published9 Jan 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-x7m9-mv49-fv73 · GHSA
CVE-2024-55225 · NVD
CVE-2024-55225 · OSV
Track software like this
Free during beta