[PR #5110] Hide user name on invite status #2656

New Issue

OVERLORD · 2025-10-09T18:09:08+03:00

OVERLORD commented

2025-10-09 18:09:08 +03:00

Original Pull Request: https://github.com/dani-garcia/vaultwarden/pull/5110

State: closed
Merged: Yes

A possible user disclosure when you invite an user into an organization which already has an account on the same instance. This was because we always returned the user's name. To prevent this, this PR only returns the user's name if the status is accepted or higher, else we will return null. This is the same as Bitwarden does.

Resolves a reported issue.

Also resolved a new nightly reported clippy regarding a regex within a loop.

**Original Pull Request:** https://github.com/dani-garcia/vaultwarden/pull/5110 **State:** closed **Merged:** Yes --- A possible user disclosure when you invite an user into an organization which already has an account on the same instance. This was because we always returned the user's name. To prevent this, this PR only returns the user's name if the status is accepted or higher, else we will return null. This is the same as Bitwarden does. Resolves a reported issue. Also resolved a new `nightly` reported clippy regarding a regex within a loop.

OVERLORD added the pull-request label 2025-10-09 18:09:08 +03:00

OVERLORD closed this issue

2025-10-09 18:09:09 +03:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#2656