Organization permission issues #690

New Issue

OVERLORD · 2026-02-04T22:14:01+03:00

OVERLORD commented

2026-02-04 22:14:01 +03:00

Originally created by @new2t on GitHub (Apr 18, 2020).

Subject of the issue

Your environment

Bitwarden_rs version:

Install method:
Clients used:
Reverse proxy and version:
Version of mysql/postgresql:
Other relevant information:

Steps to reproduce

Invite and Confirm a user with USER TYPE="User" and ACCESS CONTROL="This user can access only the selected collections." and select no collections.

Expected behaviour

Read Only user cannot add item to the organization.

Actual behaviour

Log in as the user and add an item, either from the organization or set the ownership to the organization. The COLLETIONS will show "There are no collections to list.", but pressing save will create an item in the organization in the "Unassigned" collection.

Additionally, if the user is added to a collection with "Read Only" persmissions, this collection will show in COLLECTIONS when adding an item. If the Read Only Collection is selected, then pressing save will generate a "No rights to modify the collection" error, however an item will be created in the USER's vault with null values.

These behaviors are not present in the official release.

Relevant logs

Originally created by @new2t on GitHub (Apr 18, 2020).  ### Subject of the issue  ### Your environment  * Bitwarden_rs version:  * Install method: * Clients used:  * Reverse proxy and version:  * Version of mysql/postgresql:  * Other relevant information: ### Steps to reproduce  Invite and Confirm a user with USER TYPE="User" and ACCESS CONTROL="This user can access only the selected collections." and select no collections. ### Expected behaviour  Read Only user cannot add item to the organization. ### Actual behaviour  Log in as the user and add an item, either from the organization or set the ownership to the organization. The COLLETIONS will show "There are no collections to list.", but pressing save will create an item in the organization in the "Unassigned" collection. Additionally, if the user is added to a collection with "Read Only" persmissions, this collection will show in COLLECTIONS when adding an item. If the Read Only Collection is selected, then pressing save will generate a "No rights to modify the collection" error, however an item will be created in the USER's vault with null values. These behaviors are not present in the official release. ### Relevant logs

OVERLORD added the good first issue bug labels 2026-02-04 22:14:01 +03:00

OVERLORD closed this issue

2026-02-04 22:14:03 +03:00

OVERLORD commented

2026-02-04 22:14:05 +03:00

@BlackDex commented on GitHub (Dec 12, 2020):

This is an issue indeed. We do have to find a good way to solve this, since all ciphers added already too an organization without a collection need to be linked to one before we can even go and fix this.

The only way would be to have at least owners and admins still have access to those (which probably is already the case since there is not check on collections for them). But then owners or admins do need to go and check if all the ciphers/items do have a collection!

I also see someone tried to create a PR for this, but it has not been picked up after some review requests to change some stuff.
What we should fix is no org item can be without a collection.

Maybe we could add some counter to the admin page to show how many cipher linked to a connection aren't linked to a collection. That would at least make it visible :).

Thanks for reporting this issue.

@BlackDex commented on GitHub (Dec 12, 2020): This is an issue indeed. We do have to find a good way to solve this, since all ciphers added already too an organization without a collection need to be linked to one before we can even go and fix this. The only way would be to have at least owners and admins still have access to those (which probably is already the case since there is not check on collections for them). But then owners or admins do need to go and check if all the ciphers/items do have a collection! I also see someone tried to create a PR for this, but it has not been picked up after some review requests to change some stuff. What we should fix is no org item can be without a collection. Maybe we could add some counter to the admin page to show how many cipher linked to a connection aren't linked to a collection. That would at least make it visible :). Thanks for reporting this issue.

OVERLORD commented

2026-02-04 22:14:08 +03:00

@BlackDex commented on GitHub (Jan 31, 2021):

@new2t, i have created a PR which would solve this issue.
It's a PR with a lot of changes, so it could take some time for it to be merged because of checks and maybe some additional changes which have to be made.

@BlackDex commented on GitHub (Jan 31, 2021): @new2t, i have created a PR which would solve this issue. It's a PR with a lot of changes, so it could take some time for it to be merged because of checks and maybe some additional changes which have to be made.

OVERLORD referenced this issue

2026-02-05 04:55:29 +03:00

[PR #690] [MERGED] Added http favicon url when response failed #2750

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#690