CVE-2024-39925

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a copy of the organization key. Additionally, the application fails to adequately protect some encrypted data stored on the server. Consequently, an authenticated user could gain unauthorized access to encrypted data of any organization, even if the user is not a member of the targeted organization. However, the user would need to know the corresponding organizationId. Hence, if a user (whose access to an organization has been revoked) already possesses the organization key, that user could use the key to decrypt the leaked data.

• CWE-200

• https://github.com/dani-garcia/vaultwarden/releasesRelease Notes
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0Release Notes
• https://www.mgm-sp.com/cve/missing-rotation-of-the-organization-keyThird Party Advisory

Published

Sep 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3992The Amen WordPress plugin through 3.3.1 does not sanitise an…4.8
• CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that …4.3
• CVE-2024-39921Observable timing discrepancy issue exists in IPCOM EX2 Seri…7.5
• CVE-2024-39922A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.1
• CVE-2024-39923An issue was discovered in Mahara 24.04 before 24.04.2 and 2…6.1
• CVE-2024-39924An issue was discovered in Vaultwarden (formerly Bitwarden_R…8.8
• CVE-2024-39926An issue was discovered in Vaultwarden (formerly Bitwarden_R…5.4
• CVE-2024-39927Out-of-bounds write vulnerability exists in Ricoh MFPs and p…8.2
• CVE-2024-39928In Apache Linkis <= 1.5.0, a Random string security vulnerab…7.5
• CVE-2024-39929Exim through 4.97.1 misparses a multiline RFC 2231 header fi…5.4
• CVE-2024-3993The AZAN Plugin WordPress plugin through 0.6 does not have C…4.6
• CVE-2024-39930The built-in SSH server of Gogs through 0.13.0 allows argume…9.9