[GH-ISSUE #33] Protect Organization related GET requests #10

New issue

Closed

opened 2026-03-03 01:23:44 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 01:23:44 +03:00

Owner

Originally created by @mprasil on GitHub (May 29, 2018).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/33

It seems that we don't really check user's access rights when doing /organization/* API calls. While this is mostly harmless in theory, we should probably protect all of these under some common check.

It think implementing some form of request guard would probably be the best way to handle that.

Originally created by @mprasil on GitHub (May 29, 2018). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/33 It seems that we don't really check user's access rights when doing `/organization/*` API calls. While this is mostly harmless in theory, we should probably protect all of these under some common check. It think implementing some form of request guard would probably be the best way to handle that.