--- snapshot-1789251397+++ snapshot-1789338460@@ -2,7 +2,11 @@ 
 Release notes from vaultwarden
 
-2026-08-22T12:09:11Z tag:github.com,2008:Repository/121898717/1.37.2 2026-08-24T09:42:38Z
+2026-09-13T14:43:22Z tag:github.com,2008:Repository/121898717/1.37.3 2026-09-13T15:03:37Z
+
+1.37.3
+
+<h2>What's Changed</h2> <ul> <li>Fix password change with newer web-vault by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5235398205" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7634" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7634/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7634">#7634</a></li> <li>chore: remove duplicate "the" in ciphers.rs comment by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mvanhorn/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mvanhorn">@mvanhorn</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4522477263" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7254" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7254/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7254">#7254</a></li> <li>Ignore reset-password auto-enroll when mail is disabled by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/xhon-pelushi/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/xhon-pelushi">@xhon-pelushi</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5127261724" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7585" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7585/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7585">#7585</a></li> <li>Fix migration for MariaDB 12.2.2 by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Timshel/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Timshel">@Timshel</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4534165890" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7265" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7265/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7265">#7265</a></li> <li>Add SSO_SIGNUPS_ALLOWED by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Timshel/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Timshel">@Timshel</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4540429166" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7272" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7272/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7272">#7272</a></li> <li>log_event take enum parameter not i32 by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Timshel/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Timshel">@Timshel</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5254607811" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7656" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7656/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7656">#7656</a></li> <li>Misc Updates by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5313778494" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7676" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7676/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7676">#7676</a></li> <li>Update rust docker version by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/dani-garcia/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/dani-garcia">@dani-garcia</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5340483217" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7689" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7689/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7689">#7689</a></li> <li>Fix organization import failing with missing field groups by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tom27052006/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tom27052006">@tom27052006</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5367287854" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7699" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7699/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7699">#7699</a></li> <li>Add <code>pm-32413-multi-client-password-management</code> feature flag by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tom27052006/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tom27052006">@tom27052006</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5314647695" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7677" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7677/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7677">#7677</a></li> <li>Log IP/username on two-factor email-login credential failures by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/crahn/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/crahn">@crahn</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5249704582" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7654" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7654/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7654">#7654</a></li> <li>Support admin reset 2fa by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Timshel/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Timshel">@Timshel</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4910399891" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7435" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7435/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7435">#7435</a></li> <li>fix(security): revoke 2FA remember tokens when credentials or 2FA change by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BryanFRD/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BryanFRD">@BryanFRD</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5325801241" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7682" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7682/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7682">#7682</a></li> <li>fix(security): rate limit prelogin and auth request endpoints by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BryanFRD/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BryanFRD">@BryanFRD</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5323383684" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7681" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7681/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7681">#7681</a></li> <li>fix: Correct invalid comment syntax in .dockerignore by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/niniconi/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/niniconi">@niniconi</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4547105822" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7274" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7274/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7274">#7274</a></li> <li>Update Rust and adjust DockerSettings by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5347162000" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7690" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7690/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7690">#7690</a></li> <li>Route service clients through shared HTTP setup by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/txase/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/txase">@txase</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5237644848" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7639" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7639/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7639">#7639</a></li> <li>Fix iOS registration token response by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tom27052006/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tom27052006">@tom27052006</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5386870772" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7714" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7714/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7714">#7714</a></li> <li>Use insert_into when possible by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Timshel/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Timshel">@Timshel</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3590925724" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6437" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6437/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6437">#6437</a></li> <li>Fix archiveDate update by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5401040592" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7722" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7722/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7722">#7722</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mvanhorn/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mvanhorn">@mvanhorn</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4522477263" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7254" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7254/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7254">#7254</a></li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/xhon-pelushi/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/xhon-pelushi">@xhon-pelushi</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5127261724" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7585" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7585/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7585">#7585</a></li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/crahn/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/crahn">@crahn</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5249704582" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7654" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7654/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7654">#7654</a></li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BryanFRD/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BryanFRD">@BryanFRD</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5325801241" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7682" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7682/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7682">#7682</a></li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/niniconi/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/niniconi">@niniconi</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4547105822" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/7274" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/7274/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/7274">#7274</a></li> </ul> <p><strong>Full Changelog</strong>: <a class="commit-link" href="https://github.com/dani-garcia/vaultwarden/compare/1.37.2...1.37.3"><tt>1.37.2...1.37.3</tt></a></p> BlackDex tag:github.com,2008:Repository/121898717/1.37.2 2026-08-24T09:42:38Z
 
 1.37.2
 
@@ -38,8 +42,4 @@ 
 1.35.4
 
-<h2>Security Fixes</h2> <p>This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.</p> <ul> <li><a href="https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh">GHSA-w9f8-m526-h7fh</a>. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.</li> <li><a href="https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27">GHSA-h4hq-rgvh-wh27</a>. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.</li> <li><a href="https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-r32r-j5jq-3w4m">GHSA-r32r-j5jq-3w4m</a>. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.</li> </ul> <p>These are private for now, pending CVE assignment.</p> <h2>What's Changed</h2> <ul> <li>Update Rust and Crates and GHA by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3954117795" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6843" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6843/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6843">#6843</a></li> <li>hide remember 2fa token by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/stefan0xC/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/stefan0xC">@stefan0xC</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3964335580" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6852" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6852/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6852">#6852</a></li> <li>fix(send_invite): invite links by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/proofofcopilot/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/proofofcopilot">@proofofcopilot</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3935829504" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6824" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6824/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6824">#6824</a></li> <li>Misc organization fixes by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3980050194" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6867" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6867/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6867">#6867</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/proofofcopilot/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/proofofcopilot">@proofofcopilot</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3935829504" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6824" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6824/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6824">#6824</a></li> </ul> <p><strong>Full Changelog</strong>: <a class="commit-link" href="https://github.com/dani-garcia/vaultwarden/compare/1.35.3...1.35.4"><tt>1.35.3...1.35.4</tt></a></p> dani-garcia tag:github.com,2008:Repository/121898717/1.35.3 2026-02-10T20:41:27Z
-
-1.35.3
-
-<h2>Security Fixes</h2> <p>This release contains security fixes for the following advisory. We strongly advice to update as soon as possible if you believe it could affect you.</p> <ul> <li><a href="https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337">GHSA-h265-g7rm-h337</a> (Publication in process, waiting for CVE assignment)<br> This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong.</li> </ul> <h2>What's Changed</h2> <ul> <li>Fix User API Key login by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3812923759" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6712" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6712/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6712">#6712</a></li> <li>use email instead of empty name for webauhn by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/stefan0xC/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/stefan0xC">@stefan0xC</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3826655511" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6733" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6733/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6733">#6733</a></li> <li>hide password hints via CSS by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/stefan0xC/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/stefan0xC">@stefan0xC</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3823056682" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6726" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6726/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6726">#6726</a></li> <li>fix email as 2fa with auth requests by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/stefan0xC/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/stefan0xC">@stefan0xC</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3830932188" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6736" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6736/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6736">#6736</a></li> <li>Update crates, web-vault, js, workflows by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3843828973" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6749" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6749/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6749">#6749</a></li> <li>refactor: improve tooltips in diagnostics page by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tessus/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tessus">@tessus</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3864897772" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6765" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6765/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6765">#6765</a></li> <li>Empty AccountKeys when no private key by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Timshel/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Timshel">@Timshel</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3855958348" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6761" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6761/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6761">#6761</a></li> <li>fix error message for purging auth requests by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/stefan0xC/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/stefan0xC">@stefan0xC</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3881382833" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6776" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6776/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6776">#6776</a></li> <li>Misc updates, crates, rust, js, gha, vault by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3910582145" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6799" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6799/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6799">#6799</a></li> <li>Update crates and web-vault by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3922293752" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6810" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6810/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6810">#6810</a></li> <li>Fix org-details issue by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3923163517" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6811" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6811/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6811">#6811</a></li> </ul> <p><strong>Full Changelog</strong>: <a class="commit-link" href="https://github.com/dani-garcia/vaultwarden/compare/1.35.2...1.35.3"><tt>1.35.2...1.35.3</tt></a></p> dani-garcia+<h2>Security Fixes</h2> <p>This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.</p> <ul> <li><a href="https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh">GHSA-w9f8-m526-h7fh</a>. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.</li> <li><a href="https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27">GHSA-h4hq-rgvh-wh27</a>. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.</li> <li><a href="https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-r32r-j5jq-3w4m">GHSA-r32r-j5jq-3w4m</a>. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.</li> </ul> <p>These are private for now, pending CVE assignment.</p> <h2>What's Changed</h2> <ul> <li>Update Rust and Crates and GHA by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3954117795" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6843" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6843/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6843">#6843</a></li> <li>hide remember 2fa token by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/stefan0xC/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/stefan0xC">@stefan0xC</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3964335580" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6852" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6852/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6852">#6852</a></li> <li>fix(send_invite): invite links by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/proofofcopilot/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/proofofcopilot">@proofofcopilot</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3935829504" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6824" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6824/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6824">#6824</a></li> <li>Misc organization fixes by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BlackDex/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/BlackDex">@BlackDex</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3980050194" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6867" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6867/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6867">#6867</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/proofofcopilot/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/proofofcopilot">@proofofcopilot</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3935829504" data-permission-text="Title is private" data-url="https://github.com/dani-garcia/vaultwarden/issues/6824" data-hovercard-type="pull_request" data-hovercard-url="/dani-garcia/vaultwarden/pull/6824/hovercard" href="https://github.com/dani-garcia/vaultwarden/pull/6824">#6824</a></li> </ul> <p><strong>Full Changelog</strong>: <a class="commit-link" href="https://github.com/dani-garcia/vaultwarden/compare/1.35.3...1.35.4"><tt>1.35.3...1.35.4</tt></a></p> dani-garcia