Server: Add "Unshare" option to return item to personal vault

Created on 7 Dec 2017  路  3Comments  路  Source: bitwarden/server

There is no way to remove a login item that was previously shared to a collection in an organization. Rather, removing the login item from the organization collection it stays in the family organization but gets labeled "Unassigned." The login item still shows up in the personal vault with a sideways share icon, but there appears to be no way to remove it from the organization entirely so it only appears in the personal vault where it was to begin with.

Steps to produce:

  1. In a family plan account, create an organization for the family called "The Jones."
  2. Go to The Jones organization page and create a collection called "Shared Logins"
  3. Go back into a personal vault and find a login to share to the family.
  4. Click the gear icon and select "Share."
  5. Under "Organization" select "The Jones" and under collection select "Shared Logins"
  6. Note the sideways triangle share icon next to the item in the personal vault.
  7. Now, go into the Vault for "The Jones" organization and verify the login item is there under "Shared Logins." So far so good. Now let's try to undo it.
  8. Return to the personal vault, scroll down to "Shared Logins," find the login, and click the gear icon. There is no way to "unshare." The share option is now "Collections."
  9. Click "Collections" and untick "Shared Logins" and then Save.
  10. The login has returned to the personal vault but still has the sideways triangle share icon.
  11. Go back into the Vault for "The Jones" organization. The item is no longer in the "Shared Logins" collection but now appears under something called "Unassigned." There seems to be no way to get it out of the organization entirely so it only appears in the personal vault where it was to begin with.

Expected result: removing a previously-shared login item from an organization should return the item to the original owner and entirely remove it from the organization.

enhancement

Most helpful comment

Wow, no, this isn't a feature request, this is a security issue.

I found this because I'm having the exact same issue while testing. How do you removed a shared login?

I can't share a login with confidence if I can't retake control, how is it fair for me to ask the same of others.
Just going to test something...
Yup, you can edit the entry in the organization you are "no longer sharing with" and it'll update the entry in the user's personal vault.

This should be reopened as a security issue.

All 3 comments

We are moving away from tracking Bitwarden feature requests like this one as GitHub issues. We have created a Bitwarden Community Forum which has a section for submitting, voting for, and discussing product feature requests.

Please sign up on our forums, search to see if this request already exists. If so, you can vote for it and contribute to any discussions about it. If not, you can re-create the request there so that it can be properly tracked.

This issue will now be closed. Thanks!

Wow, no, this isn't a feature request, this is a security issue.

I found this because I'm having the exact same issue while testing. How do you removed a shared login?

I can't share a login with confidence if I can't retake control, how is it fair for me to ask the same of others.
Just going to test something...
Yup, you can edit the entry in the organization you are "no longer sharing with" and it'll update the entry in the user's personal vault.

This should be reopened as a security issue.

Was this page helpful?
0 / 5 - 0 ratings

Related issues

shillner picture shillner  路  5Comments

ohthehugemanatee picture ohthehugemanatee  路  3Comments

matt-h picture matt-h  路  7Comments

jasonkuehl picture jasonkuehl  路  3Comments

marcrib picture marcrib  路  5Comments