EUVD-2026-27448Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details) is missing the has_full_access() authorization check that exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve the names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. This issue has been fixed in version 1.35.5.
AnalysisAI
Vaultwarden versions 1.35.4 and earlier expose organization collection metadata to Manager-role users lacking full access permissions due to a missing authorization check on the get_org_collections_details endpoint. An authenticated Manager with accessAll=False and no collection assignments can retrieve collection names, UUIDs, and user-to-collection and group-to-collection mappings for all organization collections, representing a confidentiality breach of sensitive organizational structure data. The vulnerability is limited to authenticated users with specific role attributes and has been patched in version 1.35.5.
Technical ContextAI
Vaultwarden is a Bitwarden-compatible password vault server written in Rust. The vulnerability stems from a missing authorization control (CWE-862: Missing Authorization) in the REST API endpoint GET /api/organizations/{org_id}/collections/details. The sibling endpoint get_org_collections implements a has_full_access() check that validates whether a Manager user should be permitted to view all collections, but this authorization gate was omitted from get_org_collections_details. The affected CPE is cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*, covering all versions through 1.35.4. The root cause is insufficient role-based access control (RBAC) enforcement at the API layer, allowing information disclosure based on role and accessAll flag state rather than explicit collection assignment permissions.
RemediationAI
Upgrade Vaultwarden to version 1.35.5 or later immediately. The vendor-released patch directly addresses the authorization check deficiency by implementing the missing has_full_access() validation on the get_org_collections_details endpoint. Administrators deploying from source should rebuild from the 1.35.5 tag; Docker users should pull the latest vaultwarden:latest or vaultwarden:1.35.5 image. If immediate upgrading is not feasible, deploy a reverse proxy (nginx, Apache, or application firewall) to restrict access to the /api/organizations/*/collections/details endpoint to only users requiring it, or disable the endpoint entirely if not in use. Note that the 1.35.5 release also includes security fixes for three additional advisories (GHSA-937x-3j8m-7w7p, GHSA-569v-845w-g82p, GHSA-6j4w-g4jh-xjfx) related to organizational privilege escalation and token invalidation, and mandates regeneration of Two Factor Remember Tokens (valid for max 30 days post-upgrade). Admin template overrides must be updated per release notes. See vendor advisory at https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jjxg-p3v6-52ww.
More in Vaultwarden
View allTwo-factor authentication bypass in Vaultwarden 1.34.3 and earlier allows authenticated attackers to circumvent 2FA prot
Cross-organization authorization bypass in Vaultwarden (the Rust-based, self-hosted Bitwarden-compatible server) prior t
Vaultwarden versions prior to 1.35.4 fail to properly enforce collection management permissions, allowing authenticated
Vaultwarden versions before 1.35.4 contain a privilege escalation vulnerability that allows authenticated Manager-level
Session hijacking via a broken SSO/OAuth authorization flow affects Vaultwarden (the Rust-based Bitwarden-compatible ser
Improper authorization in Vaultwarden (self-hosted Bitwarden-compatible server) before 1.35.5 lets an authenticated user
Authentication bypass (account takeover) in Vaultwarden before 1.36.0 allows an attacker who controls a federated identi
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Rated high sev
Brute-force protection bypass in Vaultwarden (the Rust Bitwarden-compatible server) before 1.35.4 lets unauthenticated r
Vaultwarden's SSO discovery endpoint exposed real organization SSO metadata - including organizationIdentifier values -
Insufficient session expiration in Vaultwarden prior to 1.35.5 allows an attacker holding a previously obtained refresh
Vaultwarden versions prior to 1.35.3 allow authenticated organization members to bypass collection-level access controls
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today