New CVE

[dm82m]

Problem

there is a critical cve reported and fixed: https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.7

Proposed changes

Update to the latest version.

maybe you could upgrade it @frenck , much appreciated.

[dm82m]

Renovate already updated, so only the release is open: 47b6562

[sinclairpaul]

Adding the details of the workarounds, which likely already apply to the majority of users. Should note ORG_GROUPS_ENABLED is default to off.

Workarounds
If it's not possible to update to 1.32.7, some possible workarounds are:

Disabling ORG_GROUPS_ENABLED, which would disable groups functionality on the server.
Disabling SIGNUPS_ALLOWED, which would not allow an attacker to create new accounts on the server.

[frenck]

https://github.com/hassio-addons/addon-bitwarden/releases/tag/v0.23.7