Unable to share attachments #1315

New Issue

OVERLORD · 2025-10-09T17:11:06+03:00

OVERLORD commented

2025-10-09 17:11:06 +03:00

Originally created by @jrkoiter on GitHub.

Subject of the issue

When sharing an item that has one or more attachments, the following error is generated by Vaultwarden: "ciphers should not have any attachments". Result is that a user with whom the item is shared, is able to see the item and its details, but the user does not see any attachments.

Deployment environment

Your environment (Generated via diagnostics page)

Vaultwarden version: v1.22.2
Web-vault version: v2.21.1
Running within Docker: true
Environment settings overridden: false
Uses a reverse proxy: true
IP Header check: true (X-Real-IP)
Internet access: true
Internet access via a proxy: false
DNS Check: true
Time Check: true
Domain Configuration Check: true
HTTPS Check: true
Database type: SQLite
Database version: 3.35.4
Clients used:
Reverse proxy and version:
Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_ip_header_enabled": true,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_max_conns": 10,
  "database_url": "****/**.*******",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*****.*******.**",
  "domain_origin": "*****://*****.*******.**",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "enable_db_wal": true,
  "extended_logging": true,
  "helo_name": "*******",
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "invitation_org_name": "Redacted",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "org_attachment_limit": null,
  "org_creation_users": "********@*******.**",
  "password_iterations": 100000,
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "*******.**",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_explicit_tls": true,
  "smtp_from": "******@*******.**",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": "****.*****.***",
  "smtp_password": "***",
  "smtp_port": 465,
  "smtp_ssl": true,
  "smtp_timeout": 15,
  "smtp_username": "******@*******.**",
  "templates_folder": "data/templates",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": true,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

vaultwarden version: 1.22.2

Install method: Docker image
Clients used: web vault
Reverse proxy and version: nginx/1.18.0 (Ubuntu)
MySQL/MariaDB or PostgreSQL version:
Other relevant details:

Steps to reproduce

Expected behaviour

Expected behaviour is that all users with which an item is shared, can see and access its attachments.

Actual behaviour

User can see the shared item, but there are not attachments. Attachments are still visible for the original owner of the item.

Troubleshooting data

Originally created by @jrkoiter on GitHub.   ### Subject of the issue When sharing an item that has one or more attachments, the following error is generated by Vaultwarden: "ciphers should not have any attachments". Result is that a user with whom the item is shared, is able to see the item and its details, but the user does not see any attachments. ### Deployment environment ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.22.2 * Web-vault version: v2.21.1 * Running within Docker: true * Environment settings overridden: false * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Time Check: true * Domain Configuration Check: true * HTTPS Check: true * Database type: SQLite * Database version: 3.35.4 * Clients used: * Reverse proxy and version: * Other relevant information: ### Config (Generated via diagnostics page) <details><summary>Show Running Config</summary> **Environment settings which are overridden:** ```json { "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": true, "_ip_header_enabled": true, "admin_token": "***", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "authenticator_disable_time_drift": false, "data_folder": "data", "database_max_conns": 10, "database_url": "****/**.*******", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://*****.*******.**", "domain_origin": "*****://*****.*******.**", "domain_path": "", "domain_set": true, "duo_host": null, "duo_ikey": null, "duo_skey": null, "email_attempts_limit": 3, "email_expiration_time": 600, "email_token_size": 6, "enable_db_wal": true, "extended_logging": true, "helo_name": "*******", "hibp_api_key": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "invitation_org_name": "Redacted", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "Info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "org_attachment_limit": null, "org_creation_users": "********@*******.**", "password_iterations": 100000, "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "*******.**", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_explicit_tls": true, "smtp_from": "******@*******.**", "smtp_from_name": "Vaultwarden", "smtp_host": "****.*****.***", "smtp_password": "***", "smtp_port": 465, "smtp_ssl": true, "smtp_timeout": 15, "smtp_username": "******@*******.**", "templates_folder": "data/templates", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_syslog": false, "user_attachment_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "websocket_address": "0.0.0.0", "websocket_enabled": true, "websocket_port": 3012, "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details>    * vaultwarden version: 1.22.2  * Install method: Docker image * Clients used:  web vault * Reverse proxy and version:  nginx/1.18.0 (Ubuntu) * MySQL/MariaDB or PostgreSQL version:  * Other relevant details: ### Steps to reproduce  ### Expected behaviour Expected behaviour is that all users with which an item is shared, can see and access its attachments. ### Actual behaviour User can see the shared item, but there are not attachments. Attachments are still visible for the original owner of the item. ### Troubleshooting data

OVERLORD added the bug label 2025-10-09 17:11:06 +03:00

OVERLORD closed this issue

2025-10-09 17:11:06 +03:00

OVERLORD commented

2025-10-09 17:11:08 +03:00

@jrkoiter commented on GitHub:

Thanks for the quick reply, you are absolutely right: the items with attachments are not shared, only the ones without. I mixed them up. Sharing them individually does indeed work, thanks for this workaround, and for the quick diagnosis even though my report was not fully correct!

@jrkoiter commented on GitHub: Thanks for the quick reply, you are absolutely right: the items with attachments are not shared, only the ones without. I mixed them up. Sharing them individually does indeed work, thanks for this workaround, and for the quick diagnosis even though my report was not fully correct!

OVERLORD commented

2025-10-09 17:11:09 +03:00

@jjlin commented on GitHub:

This issue only occurs when you share via "Share Selected". I'll open a PR to fix this shortly, but in the meantime, if you share items individually, it should work fine.

BTW, when you get this error message, it should abort the share. Although the UI may show the item as shared until the next refresh, it's not actually shared.

@jjlin commented on GitHub: This issue only occurs when you share via "Share Selected". I'll open a PR to fix this shortly, but in the meantime, if you share items individually, it should work fine. BTW, when you get this error message, it should abort the share. Although the UI may show the item as shared until the next refresh, it's not actually shared.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#1315