1.32.7

[BlackDex]

Security Fixes

We have yet a few other security fixes for this release. We discovered that groups were able to be edited by any admin from any organization because the organization was not validated or used within the query. This could potentially allow an admin from other organizations to modify, or delete groups from any organization if they know the uuid of the group.
We suggest people to update a.s.a.p. to mitigate this risk.

What's Changed

• feat: mask _smtp_img_src in support string by @tessus in feat: mask _smtp_img_src in support string #5281
• Some refactoring and optimizations by @BlackDex in Some refactoring, optimizations and security fixes #5291
• Allow adding connect-src entries by @BlackDex in Allow adding connect-src entries #5293
• Use updated fern instead of patch by @BlackDex in Use updated fern instead of patch #5298

Full Changelog: 1.32.6...1.32.7

---

This discussion was created from the release 1.32.7.

[formatBCE]

For some reason, my Vaultwarden is pretty slow and unresponsive on this version. Rolled back to 1.32.6, running smooth.
No issues in logs.

[BlackDex]

I'm not seeing anything which could affect this in any way.
I would suggest to reinstall it again, restart afterwards also maybe and check again.

Also, which client? And what are the response times/logs mention?

[rusti4]

Bitwarden Android app updated to
Version: 2025.1.0 (19622)
📱 google Pixel 9 Pro XL 🤖 15@35 📦 prod
local

However since this update our web vault has stopped syncing for me. Vaultwarden Version 2024.6.2. other users within my org have not yet upgraded to the new version of BW so do t have any issues.

[BlackDex]

Which version of Vaultwarden are you running?
2024.6.2 is only the web-vault.

There were some issues which are fixed in the testing version off Vaultwarden. Those might help.