Vulnerability Report

CVE-2024-39924

Title: Dani-Garcia Vaultwarden

Other

Proof Of Concept

PoC Available for CVE-2024-39924

CWE Category CWE-276
Published Date Sep 13, 2024
Modified Date Jul 10, 2025
Exploit Status Available
Score 8.8 CVSS v3.1
Exploit Probability (EPSS)
13.33%

Vulnerability Summary

CVE-2024-39924: An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault (when only intended to have read access) while bypassing the necessary wait period.

Impacted Vendors

D
dani-garcia 1

Reference Links

https://github.com/dani-garcia/vaultwarden/blob/1.30.3/src/api/core/emergency_access.rs#L115-L148 https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0 https://www.mgm-sp.com/cve/missing-authentication-check-for-emergency-access
CVSS v3.1
Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0
Severity HIGH
8.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2024-39924 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/l4rm4nd/PoC-CVE-2024-39924
View Code
MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.