The permission labels in the collection management UI are ambiguously worded and easily misread. Labels containing the phrase "hidden passwords" are intended to mean the password is hidden from a user with that permission, but the phrasing reads as though "hidden passwords" is an additional capability being granted.
Example:
The label "Edit items, hidden passwords" is naturally parsed as:
"Edit items and hidden passwords" (granting two abilities)
When the intended meaning is:
"Edit items; passwords are hidden" (granting edit access, but with passwords obscured)
Reverse Proxy
no
Host/Server Operating System
Linux
Operating System Version
debian 12
Clients
Web Vault
Client Version
No response
Steps To Reproduce
Log in to admin console
Click on "Members"
Click on any member
Select a Collection from the dropdown
Click on the Permissions dropdown
See list of permissions, with ambiguous wording
Expected Result
Suggested fix:
Reword the labels to make the restriction unambiguous, e.g.:
This is a security-sensitive area. A user configuring access could grant broader visibility than intended (or believe a password is hidden when they think they're granting an extra capability), because the label structure suggests "hidden passwords" is something being added rather than a restriction on what's visible.
Logs
Screenshots or Videos
No response
Additional Context
No response
Originally created by @shift-tyson on GitHub (Jun 22, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/7364
### Prerequisites
- [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=)
- [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/)
### Vaultwarden Support String
### Your environment (Generated via diagnostics page)
* Vaultwarden version: v1.36.0
* Web-vault version: v2026.4.1
* OS/Arch: linux/x86_64
* Running within a container: true (Base: Debian)
* Database type: SQLite
* Database version: 3.51.3
* Uses config.json: true
* Uses a reverse proxy: true
* IP Header check: true (X-Real-IP)
* Internet access: true
* Internet access via a proxy: false
* DNS Check: true
* Browser/Server Time Check: true
* Server/NTP Time Check: true
* Domain Configuration Check: true
* HTTPS Check: true
* Websocket Check: true
* HTTP Response Checks: true
### Config & Details (Generated via diagnostics page)
<details><summary>Show Config & Details</summary>
**Environment settings which are overridden:** DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN, SMTP_HOST, SMTP_SECURITY, SMTP_PORT, SMTP_FROM, SMTP_USERNAME, SMTP_PASSWORD, SMTP_AUTH_MECHANISM
**Config:**
```json
{
"_duo_akey": null,
"_enable_duo": true,
"_enable_email_2fa": true,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "",
"_icon_service_url": "",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "***:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_connect_src": "",
"allowed_iframe_ancestors": "",
"attachments_folder": "data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "data",
"database_conn_init": "",
"database_idle_timeout": 600,
"database_max_conns": 10,
"database_min_conns": 2,
"database_timeout": 30,
"database_url": "***************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"dns_prefer_ipv6": false,
"domain": "*****://**********************",
"domain_origin": "*****://**********************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "internal",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Vaultwarden",
"invitations_allowed": true,
"ip_header": "X-Real-IP",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "info",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 600000,
"purge_incomplete_sso_auth": "0 20 0 * * *",
"push_enabled": false,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": true,
"sends_folder": "data/sends",
"show_password_hint": false,
"signups_allowed": false,
"signups_domains_whitelist": "",
"signups_verify": false,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": "Login",
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "**********************",
"smtp_from_name": "***********",
"smtp_host": "**********************",
"smtp_password": "***",
"smtp_port": 587,
"smtp_security": "starttls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": "**********************",
"sso_allow_unknown_email_verification": false,
"sso_audience_trusted": null,
"sso_auth_only_not_session": false,
"sso_authority": "",
"sso_authorize_extra_params": "",
"sso_callback_path": "*****://***************************************************",
"sso_client_cache_expiration": 0,
"sso_client_id": "",
"sso_client_secret": "***",
"sso_debug_tokens": false,
"sso_enabled": false,
"sso_master_password_policy": null,
"sso_only": false,
"sso_pkce": true,
"sso_scopes": "email profile",
"sso_signups_match_email": true,
"templates_folder": "data/templates",
"tmp_folder": "data/tmp",
"trash_auto_delete_days": null,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": null,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
}
```
</details>
### Vaultwarden Build Version
1.36.0
### Deployment method
Official Container Image
### Custom deployment method
The permission labels in the collection management UI are ambiguously worded and easily misread. Labels containing the phrase "hidden passwords" are intended to mean the password is hidden from a user with that permission, but the phrasing reads as though "hidden passwords" is an additional capability being granted.
Example:
The label "Edit items, hidden passwords" is naturally parsed as:
"Edit items and hidden passwords" (granting two abilities)
When the intended meaning is:
"Edit items; passwords are hidden" (granting edit access, but with passwords obscured)
### Reverse Proxy
no
### Host/Server Operating System
Linux
### Operating System Version
debian 12
### Clients
Web Vault
### Client Version
_No response_
### Steps To Reproduce
1. Log in to admin console
2. Click on "Members"
3. Click on any member
4. Select a Collection from the dropdown
5. Click on the Permissions dropdown
6. See list of permissions, with ambiguous wording
<img width="945" height="671" alt="Image" src="https://github.com/user-attachments/assets/4eab5969-4a48-475e-9c19-326549b0173f" />
### Expected Result
Suggested fix:
Reword the labels to make the restriction unambiguous, e.g.:
"Edit items (passwords hidden)"
"View items (passwords hidden)"
or similar
### Actual Result
This is a security-sensitive area. A user configuring access could grant broader visibility than intended (or believe a password is hidden when they think they're granting an extra capability), because the label structure suggests "hidden passwords" is something being added rather than a restriction on what's visible.
### Logs
```text
```
### Screenshots or Videos
_No response_
### Additional Context
_No response_
GiteaMirror
added the bug label 2026-07-17 20:54:59 -05:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @shift-tyson on GitHub (Jun 22, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/7364
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN, SMTP_HOST, SMTP_SECURITY, SMTP_PORT, SMTP_FROM, SMTP_USERNAME, SMTP_PASSWORD, SMTP_AUTH_MECHANISM
Config:
Vaultwarden Build Version
1.36.0
Deployment method
Official Container Image
Custom deployment method
The permission labels in the collection management UI are ambiguously worded and easily misread. Labels containing the phrase "hidden passwords" are intended to mean the password is hidden from a user with that permission, but the phrasing reads as though "hidden passwords" is an additional capability being granted.
Example:
The label "Edit items, hidden passwords" is naturally parsed as:
"Edit items and hidden passwords" (granting two abilities)
When the intended meaning is:
"Edit items; passwords are hidden" (granting edit access, but with passwords obscured)
Reverse Proxy
no
Host/Server Operating System
Linux
Operating System Version
debian 12
Clients
Web Vault
Client Version
No response
Steps To Reproduce
Expected Result
Suggested fix:
Reword the labels to make the restriction unambiguous, e.g.:
"Edit items (passwords hidden)"
"View items (passwords hidden)"
or similar
Actual Result
This is a security-sensitive area. A user configuring access could grant broader visibility than intended (or believe a password is hidden when they think they're granting an extra capability), because the label structure suggests "hidden passwords" is something being added rather than a restriction on what's visible.
Logs
Screenshots or Videos
No response
Additional Context
No response