As a user of an organization, I can't modify an item even though I have read/write access #80

Closed
opened 2026-02-04 16:46:21 +03:00 by OVERLORD · 5 comments
Owner

Originally created by @janost on GitHub (Aug 30, 2018).

Reproduction steps:

  • Using the latest docker container.
  • Log in to the web UI as user of an organization. The user must not have access to all items in the organization, just read/write access to specific collection(s).
  • Click on an item, edit something and click "Save".

Expected result:
The request succeeds and my changes have been saved, because I have read/write access to the collection where the item is shared.

Actual result:
Red error message pops up saying "You don't have permission to add cipher directly to organization".

Remarks:
The request succeeds if the user has access to all collections in the organization. ("This user can access and modify all items.")

Background:
Failing request is:
PUT https:///api/ciphers/<CIPHER_ID>

Originally created by @janost on GitHub (Aug 30, 2018). Reproduction steps: - Using the latest docker container. - Log in to the web UI as user of an organization. The user must not have access to all items in the organization, just read/write access to specific collection(s). - Click on an item, edit something and click "Save". Expected result: The request succeeds and my changes have been saved, because I have read/write access to the collection where the item is shared. Actual result: Red error message pops up saying "You don't have permission to add cipher directly to organization". Remarks: The request succeeds if the user has access to all collections in the organization. ("This user can access and modify all items.") Background: Failing request is: PUT https://<HOSTNAME>/api/ciphers/<CIPHER_ID>
OVERLORD added the bug label 2026-02-04 16:46:21 +03:00
Author
Owner

@mprasil commented on GitHub (Aug 30, 2018):

Thanks for reporting that, this bug was introduced recently and hopefully should be fixed with d336d89.

@mprasil commented on GitHub (Aug 30, 2018): Thanks for reporting that, this bug was introduced recently and hopefully should be fixed with d336d89.
Author
Owner

@janost commented on GitHub (Aug 30, 2018):

Awesome, thank you!
I'm going to test it and report back.

@janost commented on GitHub (Aug 30, 2018): Awesome, thank you! I'm going to test it and report back.
Author
Owner

@mprasil commented on GitHub (Aug 30, 2018):

Just be aware that the PR wasn't merged yet and even after it's merged it takes about an hour to build the docker image, so if you want to test it now, you need to build your own image.

@mprasil commented on GitHub (Aug 30, 2018): Just be aware that the PR wasn't merged yet and even after it's merged it takes about an hour to build the docker image, so if you want to test it now, you need to build your own image.
Author
Owner

@mprasil commented on GitHub (Aug 30, 2018):

The image is now building, give it about an hour and you can test the fix @janost .

@mprasil commented on GitHub (Aug 30, 2018): The image is [now building](https://hub.docker.com/r/mprasil/bitwarden/builds/bxenhmyeatac7ck5yhcsk66/), give it about an hour and you can test the fix @janost .
Author
Owner

@janost commented on GitHub (Sep 3, 2018):

Seems to work great, thank you.

@janost commented on GitHub (Sep 3, 2018): Seems to work great, thank you.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/vaultwarden#80