[GH-ISSUE #1909] Unable to share attachments #1104

New issue

Closed

opened 2026-03-03 02:06:17 +03:00 by kerem · 2 comments

kerem commented

2026-03-03 02:06:17 +03:00

Owner

Originally created by @jrkoiter on GitHub (Aug 16, 2021).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1909

Subject of the issue

When sharing an item that has one or more attachments, the following error is generated by Vaultwarden: "ciphers should not have any attachments". Result is that a user with whom the item is shared, is able to see the item and its details, but the user does not see any attachments.

Deployment environment

Your environment (Generated via diagnostics page)

Vaultwarden version: v1.22.2
Web-vault version: v2.21.1
Running within Docker: true
Environment settings overridden: false
Uses a reverse proxy: true
IP Header check: true (X-Real-IP)
Internet access: true
Internet access via a proxy: false
DNS Check: true
Time Check: true
Domain Configuration Check: true
HTTPS Check: true
Database type: SQLite
Database version: 3.35.4
Clients used:
Reverse proxy and version:
Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_ip_header_enabled": true,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_max_conns": 10,
  "database_url": "****/**.*******",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*****.*******.**",
  "domain_origin": "*****://*****.*******.**",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "enable_db_wal": true,
  "extended_logging": true,
  "helo_name": "*******",
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "invitation_org_name": "Redacted",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "org_attachment_limit": null,
  "org_creation_users": "********@*******.**",
  "password_iterations": 100000,
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "*******.**",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_explicit_tls": true,
  "smtp_from": "******@*******.**",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": "****.*****.***",
  "smtp_password": "***",
  "smtp_port": 465,
  "smtp_ssl": true,
  "smtp_timeout": 15,
  "smtp_username": "******@*******.**",
  "templates_folder": "data/templates",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": true,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

vaultwarden version: 1.22.2

Install method: Docker image
Clients used: web vault
Reverse proxy and version: nginx/1.18.0 (Ubuntu)
MySQL/MariaDB or PostgreSQL version:
Other relevant details:

Steps to reproduce

Expected behaviour

Expected behaviour is that all users with which an item is shared, can see and access its attachments.

Actual behaviour

User can see the shared item, but there are not attachments. Attachments are still visible for the original owner of the item.

Troubleshooting data

Originally created by @jrkoiter on GitHub (Aug 16, 2021). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1909   ### Subject of the issue When sharing an item that has one or more attachments, the following error is generated by Vaultwarden: "ciphers should not have any attachments". Result is that a user with whom the item is shared, is able to see the item and its details, but the user does not see any attachments. ### Deployment environment ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.22.2 * Web-vault version: v2.21.1 * Running within Docker: true * Environment settings overridden: false * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Time Check: true * Domain Configuration Check: true * HTTPS Check: true * Database type: SQLite * Database version: 3.35.4 * Clients used: * Reverse proxy and version: * Other relevant information: ### Config (Generated via diagnostics page) <details><summary>Show Running Config</summary> **Environment settings which are overridden:** ```json { "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": true, "_ip_header_enabled": true, "admin_token": "***", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "authenticator_disable_time_drift": false, "data_folder": "data", "database_max_conns": 10, "database_url": "****/**.*******", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://*****.*******.**", "domain_origin": "*****://*****.*******.**", "domain_path": "", "domain_set": true, "duo_host": null, "duo_ikey": null, "duo_skey": null, "email_attempts_limit": 3, "email_expiration_time": 600, "email_token_size": 6, "enable_db_wal": true, "extended_logging": true, "helo_name": "*******", "hibp_api_key": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "invitation_org_name": "Redacted", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "Info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "org_attachment_limit": null, "org_creation_users": "********@*******.**", "password_iterations": 100000, "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "*******.**", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_explicit_tls": true, "smtp_from": "******@*******.**", "smtp_from_name": "Vaultwarden", "smtp_host": "****.*****.***", "smtp_password": "***", "smtp_port": 465, "smtp_ssl": true, "smtp_timeout": 15, "smtp_username": "******@*******.**", "templates_folder": "data/templates", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_syslog": false, "user_attachment_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "websocket_address": "0.0.0.0", "websocket_enabled": true, "websocket_port": 3012, "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details>    * vaultwarden version: 1.22.2  * Install method: Docker image * Clients used:  web vault * Reverse proxy and version:  nginx/1.18.0 (Ubuntu) * MySQL/MariaDB or PostgreSQL version:  * Other relevant details: ### Steps to reproduce  ### Expected behaviour Expected behaviour is that all users with which an item is shared, can see and access its attachments. ### Actual behaviour User can see the shared item, but there are not attachments. Attachments are still visible for the original owner of the item. ### Troubleshooting data

kerem

2026-03-03 02:06:17 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-03 02:06:18 +03:00

Author

Owner

@jjlin commented on GitHub (Aug 17, 2021):

This issue only occurs when you share via "Share Selected". I'll open a PR to fix this shortly, but in the meantime, if you share items individually, it should work fine.

BTW, when you get this error message, it should abort the share. Although the UI may show the item as shared until the next refresh, it's not actually shared.

@jjlin commented on GitHub (Aug 17, 2021): This issue only occurs when you share via "Share Selected". I'll open a PR to fix this shortly, but in the meantime, if you share items individually, it should work fine. BTW, when you get this error message, it should abort the share. Although the UI may show the item as shared until the next refresh, it's not actually shared.

kerem commented

2026-03-03 02:06:18 +03:00

Author

Owner

@jrkoiter commented on GitHub (Aug 17, 2021):

Thanks for the quick reply, you are absolutely right: the items with attachments are not shared, only the ones without. I mixed them up. Sharing them individually does indeed work, thanks for this workaround, and for the quick diagnosis even though my report was not fully correct!

@jrkoiter commented on GitHub (Aug 17, 2021): Thanks for the quick reply, you are absolutely right: the items with attachments are not shared, only the ones without. I mixed them up. Sharing them individually does indeed work, thanks for this workaround, and for the quick diagnosis even though my report was not fully correct!