Ch1Nhpd

**Name of the Vulnerable Software and Affected Versions** Vaultwarden versions prior to 1.35.5 **Description** Vaultwarden fails to verify that organization UUID entries in group and collection management are consistent. Specifically, the server does not enforce that a `groups users.users organizations uuid` entry belongs to the same organization as `groups.groups uuid`, nor that a `collections groups.collections uuid` entry matches the organization of `collections groups.groups uuid`. This allows an attacker with administrative privileges in one organization and low-privileged access in another to bind a membership UUID from the second organization into a group in the first. By using an organization group with `accessAll=true`, the attacker can utilize the '/api/sync' and '/api/ciphers' endpoints to enumerate ciphers from the foreign organization. Once collection IDs are revealed, the attacker can bind those IDs to the group to obtain write access to the foreign organization's items. **Recommendations** Update to version 1.35.5.

**Name of the Vulnerable Software and Affected Versions** Vaultwarden versions prior to 1.35.5 **Description** Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The issue exists because the 'POST /api/ciphers/purge' endpoint verifies that a user has the `Owner` membership type but fails to verify that the membership status is `Confirmed`. Consequently, an authenticated user who has accepted an organization owner invite but has not yet been confirmed by an existing owner can call this endpoint to permanently delete all ciphers and attachments within the organization, leading to immediate data loss. **Recommendations** Update to version 1.35.5.

**Name of the Vulnerable Software and Affected Versions** KubePi versions prior to 1.6.5 **Description** The issue concerns the leakage of password hashes for any user, including administrators, through the `/kubepi/api/v1/users/search` endpoint. This could allow a motivated attacker to crack the leaked password hashes, potentially leading to unauthorized access. The problem is associated with leaking confidential information and can lead to password cracking attacks. **Recommendations** For versions prior to 1.6.5, upgrade to version 1.6.5 to address the issue. As a temporary workaround, consider restricting access to the `/kubepi/api/v1/users/search` endpoint until the upgrade is possible. Avoid using the `pageNum` and `pageSize` parameters in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** KubePi versions prior to 1.6.5 **Description** A normal user in KubePi, an open-source Kubernetes management panel, has the permission to create or update users. By editing the `isadmin` value in the request, any user can become an admin, thus taking administrative control of KubePi. This allows for the elevation of user privileges. **Recommendations** For versions prior to 1.6.5, upgrade to version 1.6.5 to address the issue. As a temporary workaround, consider restricting access to user creation and update functionalities to prevent potential privilege escalation. Avoid using the `isadmin` variable in requests until the issue is resolved.