What is the CVSS score of CVE-2026-27803?

CVE-2026-27803 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Vaultwarden are affected by CVE-2026-27803?

Vaultwarden instances running versions prior to 1.35.4 contain an access control bypass vulnerability allowing managers with restricted permissions to perform unauthorized collection management…. A patch is available.

How to fix or mitigate CVE-2026-27803?

Within 24 hours: Identify all Vaultwarden deployments and document current versions; review audit logs for unauthorized manager activity on collections with manage=false permissions. Within 7 days: Implement network segmentation to restrict Vaultwarden access to essential users only; enforce multi-factor authentication for all manager accounts. Within 30 days: Deploy Vaultwarden 1.35.4 or later when available; conduct full access control audit of all collection permissions and remediate any unauthorized changes.

Vaultwarden CVE-2026-27803

HIGH

Improper Privilege Management (CWE-269)

2026-03-04 security-advisories@github.com

GHSA-h4hq-rgvh-wh27

Privilege Escalation Vaultwarden Red Hat

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Red Hat

8.3 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 22:16 nvd

HIGH 8.3

DescriptionGitHub Advisory

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

AnalysisAI

Vaultwarden versions prior to 1.35.4 fail to properly enforce collection management permissions, allowing authenticated users with Manager roles to perform restricted management operations on collections where they lack authorization. An attacker with valid credentials can exploit this privilege escalation to modify or control collections they should not have access to. No patch is currently available for affected deployments.

Technical ContextAI

Classified as CWE-269 (Improper Privilege Management). Affects Vaultwarden. Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.