mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2025-12-09 09:13:02 +03:00
No way to unshare an item from an Organization, remains accessible and editable. #2394
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Ryonez on GitHub.
Simply put, there's no way to unshare an item from an organization, and it remains accessible and editable by someone with the perms to in an organization. Even worse, those changes will done to the information in the users vault as well.
Ref to the issue on bitwarden's github: https://github.com/bitwarden/core/issues/158
This is a breaking issue for me, I can't use this with such a glaring security issue, in part of the server I actually wanted to switch to it for, sharing passwords.
@mprasil commented on GitHub:
The delete button should delete the cipher if you have enough rights within the organization. (but AFAIK you need the same access to share) I'm not sure I follow your logic there - once you shared the password, there's no "person who own the item" anymore. The cipher belongs to organization and anyone with enough rights within that organization can delete or edit the cipher.
As a side note, if you shared password by mistake, the best course of action is to change the password anyway. There's nothing stopping the other clients within the organization to save the password somewhere while it was available so deleting it should be considered more-less cleanup action not a security measure.
@Ryonez commented on GitHub:
I was unable to delete an item I had shared with the organization from within the organization. Having a look at the console, /delete-admin is returning a 404.
Is it shared, or completely shifted?
I'v also just realised, if these are all encrypted before showing up on the sever, how do the others read it?
@Ryonez commented on GitHub:
Hmm, I didn't really think of looking at it that way.
It does feel counter intuitive though. It will rely an the person who own the item to remember to create a new one and delete the old. They'll see they can remove it from the collection and think that's that.
I know one person I want to share with won't remember it.
What does the delete button for items do in organizations? It doesn't seem to do anything for me.
@mprasil commented on GitHub:
This is how it currently works in upstream Bitwarden API, so I don't think it qualifies as a bug.
As a simple workaround, you can just delete the shared cipher, that will remove it from organization so I don't think that it qualifies as a security bug either. It's inconvenient maybe, but not a security issue.
Looking at the linked bug, it looks like OP is misunderstanding the purpose of collections - they are kinda like folders to help organize ciphers within organization, but removing the cipher from all collections doesn't remove it from organization just like removing cipher from all folders doesn't remove the cipher from your personal vault.
@Ryonez commented on GitHub:
Don't worry about the encryption question, I'm going to assume the admin's client re-encrypts all the passwords when they add the user with the user's key included.
@mprasil commented on GitHub:
I've created an issue #52 to track the /delete-admin call failure. Should be easy to fix.
As for your question, the cipher ownership is completely shifted to Organization once you share it. You are no longer direct owner of that cipher and if you lost Organization membership, you'd loose the access to the cipher completely. Hope that helps.
@dani-garcia I guess you can close this now with reference to #52.
@Ryonez commented on GitHub:
Alright, good to know. Thank you for the help.