[PR #6890] prevent managers from creating collections #7499

New Issue

Open

opened 2026-03-07 21:18:33 -06:00 by GiteaMirror · 0 comments

GiteaMirror commented 2026-03-07 21:18:33 -06:00

Owner

Copy Link

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/6890
Author: @stefan0xC
Created: 3/2/2026
Status: 🔄 Open

Base: main ← Head: restrict-collection-creation

---

📝 Commits (1)

• 0c0ac89 prevent managers from creating collections

📊 Changes

2 files changed (+6 additions, -5 deletions)

View changed files

📝 src/api/core/organizations.rs (+4 -4)
📝 src/db/models/organization.rs (+2 -1)

📄 Description

managers without the access_all flag should not be able to create collections. the manage all permission consists of three separate custom permission which would need to be properly implemented first for more delegate control.

this should fix #6871 for now by both preventing managers from creating collections as well as restricting the api call for managers to the ones that have access to all collections in order to prevent permission errors.

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6890 **Author:** [@stefan0xC](https://github.com/stefan0xC) **Created:** 3/2/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `restrict-collection-creation` --- ### 📝 Commits (1) - [`0c0ac89`](https://github.com/dani-garcia/vaultwarden/commit/0c0ac898378db96d0a30c1fb71646ce40a794365) prevent managers from creating collections ### 📊 Changes **2 files changed** (+6 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `src/api/core/organizations.rs` (+4 -4) 📝 `src/db/models/organization.rs` (+2 -1) </details> ### 📄 Description managers without the access_all flag should not be able to create collections. the manage all permission consists of three separate custom permission which would need to be properly implemented first for more delegate control. <img width="232" height="192" alt="image" src="https://github.com/user-attachments/assets/213b1182-4c9d-4813-b138-9c5bf93a6a5c" /> this should fix #6871 for now by both preventing managers from creating collections as well as restricting the api call for managers to the ones that have access to all collections in order to prevent permission errors. --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

GiteaMirror added the pull-request label 2026-03-07 21:18:33 -06:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

cached-config-operations

test_dylint

1.35.4

1.35.3

1.35.2

1.35.1

1.35.0

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels

better for forum

bug

documentation

duplicate

enhancement

future Vault

good first issue

help wanted

low priority

notes

pull-request

Mirrored from GitHub Pull Request

question

SSO

Third party

troubleshooting

wontfix

No Label pull-request

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

GiteaMirror ninjasurge

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#7499