Latest Web Vault version bundled with Vaultwarden v1.34.3
Steps To Reproduce
Log in with an admin account.
Go to the "Neocom" organization.
Create a new sub-collection inside this organization.
Save it.
Go to the "Trillion" organization.
The sub-collection created under Neocom also appears under Trillion.
Expected Result
The sub-collection created in "Neocom" should only appear inside the "Neocom" organization and not in "Trillion" or any other organization.
Actual Result
The sub-collection created in "Neocom" is also displayed inside the "Trillion" organization, even though it was not created there.
Logs
No relevant errors found in logs.
Screenshots or Videos
Additional Context
This behavior is consistent and replicable. It causes confusion in credential segregation between organizations and may lead to incorrect access management.
Originally created by @ktunda on GitHub (Sep 5, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6273
### Prerequisites
- [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=)
- [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/)
### Vaultwarden Support String
### Your environment (Generated via diagnostics page)
* Vaultwarden version: v1.34.3-77008a91
* Web-vault version: v2025.7.0
* OS/Arch: linux/x86_64
* Running within a container: true (Base: Debian)
* Database type: PostgreSQL
* Database version: PostgreSQL 17.6 (Debian 17.6-1.pgdg12+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14+deb12u1) 12.2.0, 64-bit
* Uses config.json: true
* Uses a reverse proxy: true
* IP Header check: true (X-Forwarded-For)
* Internet access: false
* Internet access via a proxy: false
* DNS Check: true
* Browser/Server Time Check: true
* Server/NTP Time Check: n/a
* Domain Configuration Check: true
* HTTPS Check: true
* Websocket Check: true
* HTTP Response Checks: true
### Config & Details (Generated via diagnostics page)
<details><summary>Show Config & Details</summary>
**Environment settings which are overridden:** DOMAIN, TRASH_AUTO_DELETE_DAYS, SIGNUPS_ALLOWED, EMERGENCY_ACCESS_ALLOWED, PASSWORD_HINTS_ALLOWED, ADMIN_TOKEN, IP_HEADER, DISABLE_2FA_REMEMBER
**Config:**
```json
{
"_duo_akey": null,
"_enable_duo": false,
"_enable_email_2fa": false,
"_enable_smtp": true,
"_enable_yubico": false,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "***:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 10,
"admin_token": "***",
"allowed_connect_src": "",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_max_conns": 10,
"database_timeout": 30,
"database_url": "**********://**************************************************************************",
"db_connection_retries": 15,
"disable_2fa_remember": true,
"disable_admin_token": false,
"disable_icon_download": true,
"domain": "*****://*****************",
"domain_origin": "*****://*****************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": false,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Vaultwarden",
"invitations_allowed": false,
"ip_header": "X-Forwarded-For",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "info",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": true,
"org_groups_enabled": true,
"password_hints_allowed": false,
"password_iterations": 600000,
"purge_incomplete_sso_nonce": "0 20 0 * * *",
"push_enabled": false,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": true,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": true,
"signups_domains_whitelist": "***********",
"signups_verify": false,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": null,
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "**************************",
"smtp_from_name": "Vaultwarden",
"smtp_host": "********************",
"smtp_password": "***",
"smtp_port": 587,
"smtp_security": "starttls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": "************************",
"sso_allow_unknown_email_verification": false,
"sso_audience_trusted": null,
"sso_auth_only_not_session": false,
"sso_authority": "",
"sso_authorize_extra_params": "",
"sso_callback_path": "*****://**********************************************",
"sso_client_cache_expiration": 0,
"sso_client_id": "",
"sso_client_secret": "***",
"sso_debug_tokens": false,
"sso_enabled": false,
"sso_master_password_policy": null,
"sso_only": false,
"sso_pkce": true,
"sso_scopes": "email profile",
"sso_signups_match_email": true,
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": 30,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
}
```
</details>
### Vaultwarden Build Version
v1.34.3
### Deployment method
Official Container Image
### Custom deployment method
Official Container Image
### Reverse Proxy
Caddy 2.x
### Host/Server Operating System
Linux
### Operating System Version
Debian GNU/Linux 12 (bookworm)
### Clients
Web Vault
### Client Version
Latest Web Vault version bundled with Vaultwarden v1.34.3
### Steps To Reproduce
1. Log in with an admin account.
2. Go to the "Neocom" organization.
3. Create a new sub-collection inside this organization.
4. Save it.
5. Go to the "Trillion" organization.
6. The sub-collection created under Neocom also appears under Trillion.
### Expected Result
The sub-collection created in "Neocom" should only appear inside the "Neocom" organization and not in "Trillion" or any other organization.
### Actual Result
The sub-collection created in "Neocom" is also displayed inside the "Trillion" organization, even though it was not created there.
### Logs
```text
No relevant errors found in logs.
```
### Screenshots or Videos
<img width="1676" height="833" alt="Image" src="https://github.com/user-attachments/assets/53af66a6-a6cd-4902-8074-8e41abb23735" />
<img width="1670" height="822" alt="Image" src="https://github.com/user-attachments/assets/5bee1d41-953c-45e2-b7eb-f43faa3dc0d2" />
### Additional Context
This behavior is consistent and replicable. It causes confusion in credential segregation between organizations and may lead to incorrect access management.
GiteaMirror
added the bug label 2026-06-17 09:33:19 -05:00
You personal overview shows all items, collections etc...
That is how Bitwarden works.
Also, this is a client side item and nothing we can change on the server side.
<!-- gh-comment-id:3259732005 -->
@BlackDex commented on GitHub (Sep 5, 2025):
You personal overview shows all items, collections etc...
That is how Bitwarden works.
Also, this is a client side item and nothing we can change on the server side.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @ktunda on GitHub (Sep 5, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6273
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: DOMAIN, TRASH_AUTO_DELETE_DAYS, SIGNUPS_ALLOWED, EMERGENCY_ACCESS_ALLOWED, PASSWORD_HINTS_ALLOWED, ADMIN_TOKEN, IP_HEADER, DISABLE_2FA_REMEMBER
Config:
Vaultwarden Build Version
v1.34.3
Deployment method
Official Container Image
Custom deployment method
Official Container Image
Reverse Proxy
Caddy 2.x
Host/Server Operating System
Linux
Operating System Version
Debian GNU/Linux 12 (bookworm)
Clients
Web Vault
Client Version
Latest Web Vault version bundled with Vaultwarden v1.34.3
Steps To Reproduce
Expected Result
The sub-collection created in "Neocom" should only appear inside the "Neocom" organization and not in "Trillion" or any other organization.
Actual Result
The sub-collection created in "Neocom" is also displayed inside the "Trillion" organization, even though it was not created there.
Logs
Screenshots or Videos
Additional Context
This behavior is consistent and replicable. It causes confusion in credential segregation between organizations and may lead to incorrect access management.
@BlackDex commented on GitHub (Sep 5, 2025):
You personal overview shows all items, collections etc...
That is how Bitwarden works.
Also, this is a client side item and nothing we can change on the server side.