User with readonly access to collection entry can edit entry #145

New Issue

OVERLORD · 2026-02-04T17:54:43+03:00

OVERLORD commented

2026-02-04 17:54:43 +03:00

Originally created by @0xERR0R on GitHub (Dec 7, 2018).

Environment: last docker version

Given: User A creates an item and shares it to the default collection of organization. User B has only readonly access to this Collection

When: User B opens the shared item, he can edit it (in web vault), which is wrong. The item should apper as read only item. User B can click on save and gets error "an unexpected error is occured". Server log: "ERROR: Cipher is not write accessible".

So this is only a UIproblem, the item can't be changed

Originally created by @0xERR0R on GitHub (Dec 7, 2018). Environment: last docker version Given: User A creates an item and shares it to the default collection of organization. User B has only readonly access to this Collection When: User B opens the shared item, he can edit it (in web vault), which is wrong. The item should apper as read only item. User B can click on save and gets error "an unexpected error is occured". Server log: "ERROR: Cipher is not write accessible". So this is only a UIproblem, the item can't be changed

OVERLORD added the bug label 2026-02-04 17:54:43 +03:00

OVERLORD closed this issue

2026-02-04 17:54:46 +03:00

OVERLORD commented

2026-02-04 17:54:52 +03:00

@dani-garcia commented on GitHub (Dec 9, 2018):

So, I made a quick test in the official web vault and the ui acts the same way. The server sends a field edit which is true when the cipher is editable, but the ui doesn't seem to reflect it.

For now, I fixed the errors in the latest beta so they show less generic messages in the clients.

@dani-garcia commented on GitHub (Dec 9, 2018): So, I made a quick test in the official web vault and the ui acts the same way. The server sends a field `edit` which is true when the cipher is editable, but the ui doesn't seem to reflect it. For now, I fixed the errors in the latest beta so they show less generic messages in the clients.

OVERLORD commented

2026-02-04 17:55:10 +03:00

@mprasil commented on GitHub (Dec 10, 2018):

I think we can close this as one part of the problem is upstream and the other was fixed in beta.

@mprasil commented on GitHub (Dec 10, 2018): I think we can close this as one part of the problem is upstream and the other was fixed in beta.

OVERLORD referenced this issue

2026-02-05 04:49:48 +03:00

[PR #145] [MERGED] Organization update improvements #2604

Sign in to join this conversation.