[GH-ISSUE #163] As an org admin, assigning myself (or other admin) to a collection results in an error #80

New issue

Closed

opened 2026-03-03 01:24:39 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 01:24:39 +03:00

Owner

Originally created by @janost on GitHub (Aug 30, 2018).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/163

Reproduction steps:

Using the latest docker container.
Log in to the web UI as user who is an organization admin.
Select organization, click on the Manage tab, select People.
Click on yourself or another organization admin.
Under "Access Control" assign the user to any collection or select "This user can access and modify all items".
Click "Save".

Expected result:
The request succeeds and the edited user gains access to the selected collections.

Actual result:
Red error message pops up saying "Only Owners can grant Admin or Owner type".

Background:
Failing request is:
PUT https:///api/organizations/<ORG_ID>/users/<USER_ID>

Originally created by @janost on GitHub (Aug 30, 2018). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/163 Reproduction steps: - Using the latest docker container. - Log in to the web UI as user who is an organization admin. - Select organization, click on the Manage tab, select People. - Click on yourself or another organization admin. - Under "Access Control" assign the user to any collection or select "This user can access and modify all items". - Click "Save". Expected result: The request succeeds and the edited user gains access to the selected collections. Actual result: Red error message pops up saying "Only Owners can grant Admin or Owner type". Background: Failing request is: PUT https://<HOSTNAME>/api/organizations/<ORG_ID>/users/<USER_ID>

kerem

2026-03-03 01:24:39 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-03 01:24:40 +03:00

Author

Owner

@mprasil commented on GitHub (Aug 30, 2018):

Thanks for reporting this. Have you tested this in upstream to see how that works there? I'm not sure how to handle this as granting admin ability to edit himself and other admins essentially gives him owner-level privileges.

@mprasil commented on GitHub (Aug 30, 2018): Thanks for reporting this. Have you tested this in upstream to see how that works there? I'm not sure how to handle this as granting admin ability to edit himself and other admins essentially gives him owner-level privileges.

kerem commented

2026-03-03 01:24:40 +03:00

Author

Owner

@janost commented on GitHub (Aug 30, 2018):

I just tested this upstream.
As an organization admin, I was able to edit my own access to collections using the procedure I described in the issue. Unfortunately I can't test if I can edit other admins, because I only have a free account on upstream.

@janost commented on GitHub (Aug 30, 2018): I just tested this upstream. As an organization admin, I was able to edit my own access to collections using the procedure I described in the issue. Unfortunately I can't test if I can edit other admins, because I only have a free account on upstream.

kerem commented

2026-03-03 01:24:40 +03:00

Author

Owner

@mprasil commented on GitHub (Aug 30, 2018):

Thanks for that. I guess it's safe to assume, that it would work for other admin accounts.

@mprasil commented on GitHub (Aug 30, 2018): Thanks for that. I guess it's safe to assume, that it would work for other admin accounts.

kerem commented

2026-03-03 01:24:40 +03:00

Author

Owner

@mprasil commented on GitHub (Sep 4, 2018):

Submitted PR #170 that should also resolve this issue.

@mprasil commented on GitHub (Sep 4, 2018): Submitted PR #170 that should also resolve this issue.

kerem referenced this issue

2026-03-03 02:19:59 +03:00

[PR #89] [MERGED] Add confirmed check to the OrgHeaders request guard #2604