Summary
An authenticated regular user can specify another user’s cipher_id and call the following API:
PUT /api/ciphers/{id}/partial
Although the standard retrieval API correctly denies access to the target cipher, this partial update endpoint returns 200 OK and includes information such as cipherDetails (name, notes, data, secureNote, etc.) in the response.
Impact
- Retrieval of another user's encrypted cipher information
- Creation of unauthorized associations within the attacker's user context (e.g., favorite or folder operations)
In addition, the response from /api/ciphers/<cipher_id>/partial contains attachments[].url.
For filesystem (FS) deployments, the following tokenized endpoint is returned:
/attachments/<cipher>/<file>?token=...
For object storage deployments, a short-lived pre-signed URL is returned.
As a result, an attacker can use these URLs to directly download attachment data that they are not authorized to access.
Summary
An authenticated regular user can specify another user’s
cipher_idand call the following API:Although the standard retrieval API correctly denies access to the target cipher, this partial update endpoint returns 200 OK and includes information such as
cipherDetails(name,notes,data,secureNote, etc.) in the response.Impact
In addition, the response from
/api/ciphers/<cipher_id>/partialcontainsattachments[].url.For filesystem (FS) deployments, the following tokenized endpoint is returned:
For object storage deployments, a short-lived pre-signed URL is returned.
As a result, an attacker can use these URLs to directly download attachment data that they are not authorized to access.