Create a group in the organization by enabling “Grant access to all current and future collections”
Invite a user and add them to the group created previously.
Verify that the user has access to the organization and can create new items in the collections.
In the admin console, edit the user we just created and check the permissions on the collections.
Without making any changes, click on Save.
With the user, reconnect to the organization and try to create a new item and try to save it in the organization. You will notice that you have lost editing access to the collections
Expected Result
The permissions for the user should reflect those granted by the group (allow modification). The "save" of the user without modification should not change the permissions.
Actual Result
The permissions for the group are lost and modified to “Can view, except passwords”
Logs
No response
Screenshots or Videos
Additional Context
No response
Originally created by @ptgob on GitHub (Nov 19, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/5212
### Vaultwarden Support String
### Your environment (Generated via diagnostics page)
* Vaultwarden version: v1.32.5
* Web-vault version: v2024.6.2c
* OS/Arch: linux/x86_64
* Running within a container: true (Base: Debian)
* Environment settings overridden: true
* Uses a reverse proxy: true
* IP Header check: false (X-Forwarded-For)
* Internet access: false
* Internet access via a proxy: false
* DNS Check: false
* Browser/Server Time Check: true
* Server/NTP Time Check: n/a
* Domain Configuration Check: true
* HTTPS Check: true
* Database type: MySQL
* Database version: 11.4.4-MariaDB-ubu2404
* Clients used:
* Reverse proxy and version:
* Other relevant information:
### Config (Generated via diagnostics page)
<details><summary>Show Running Config</summary>
**Environment settings which are overridden:** DOMAIN, SIGNUPS_ALLOWED, ORG_CREATION_USERS, ADMIN_TOKEN
```
{
"_duo_akey": null,
"_enable_duo": false,
"_enable_email_2fa": false,
"_enable_smtp": false,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "cid:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_max_conns": 10,
"database_timeout": 30,
"database_url": "*****://************************************************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"domain": "*****://**************",
"domain_origin": "*****://**************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "fido2-vault-credentials",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Vaultwarden",
"invitations_allowed": true,
"ip_header": "X-Forwarder-For",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "info",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "***************",
"org_events_enabled": false,
"org_groups_enabled": true,
"password_hints_allowed": true,
"password_iterations": 600000,
"push_enabled": false,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": false,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": true,
"signups_domains_whitelist": "",
"signups_verify": false,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": null,
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "",
"smtp_from_name": "Vaultwarden",
"smtp_host": null,
"smtp_password": null,
"smtp_port": 587,
"smtp_security": "starttls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": null,
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": null,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
}
```
</details>
### Vaultwarden Build Version
v1.32.5
### Deployment method
Official Container Image
### Custom deployment method
_No response_
### Reverse Proxy
Apache 2.4.58
### Host/Server Operating System
Linux
### Operating System Version
OpenSuse Leap 15.6
### Clients
Browser Extension, Desktop
### Client Version
v2024.11.1
### Steps To Reproduce
1. Create an organization with multiple collections.
2. Create a group in the organization by enabling “Grant access to all current and future collections”
3. Invite a user and add them to the group created previously.
4. Verify that the user has access to the organization and can create new items in the collections.
5. In the admin console, edit the user we just created and check the permissions on the collections.
6. Without making any changes, click on Save.
7. With the user, reconnect to the organization and try to create a new item and try to save it in the organization. You will notice that you have lost editing access to the collections
### Expected Result
The permissions for the user should reflect those granted by the group (allow modification). The "save" of the user without modification should not change the permissions.
### Actual Result
The permissions for the group are lost and modified to “Can view, except passwords”
### Logs
_No response_
### Screenshots or Videos
### Additional Context
_No response_
GiteaMirror
added the bug label 2026-07-17 13:42:02 -05:00
Looks like the access all is not passed through from the groups, which causes this to break.
This is a nasty bug and not easy to fix as it is very complex how this is stored in the database right now.
<!-- gh-comment-id:2488132906 -->
@BlackDex commented on GitHub (Nov 20, 2024):
Looks like the access all is not passed through from the groups, which causes this to break.
This is a nasty bug and not easy to fix as it is very complex how this is stored in the database right now.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @ptgob on GitHub (Nov 19, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/5212
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config (Generated via diagnostics page)
Show Running Config
Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, ORG_CREATION_USERS, ADMIN_TOKEN
Vaultwarden Build Version
v1.32.5
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
Apache 2.4.58
Host/Server Operating System
Linux
Operating System Version
OpenSuse Leap 15.6
Clients
Browser Extension, Desktop
Client Version
v2024.11.1
Steps To Reproduce
Expected Result
The permissions for the user should reflect those granted by the group (allow modification). The "save" of the user without modification should not change the permissions.
Actual Result
The permissions for the group are lost and modified to “Can view, except passwords”
Logs
No response
Screenshots or Videos
Additional Context
No response
@BlackDex commented on GitHub (Nov 20, 2024):
Looks like the access all is not passed through from the groups, which causes this to break.
This is a nasty bug and not easy to fix as it is very complex how this is stored in the database right now.
@ptgob commented on GitHub (Nov 20, 2024):
@BlackDex , thanks for your quick response and for the fix!