EUVD-2026-29341Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain organization-owner invite
-
DeliveryAccept invite (status Accepted, unconfirmed)
-
ExploitSend POST /api/ciphers/purge
-
ExecutionType-only Owner check passes
-
ImpactHard-delete all org ciphers and attachments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be an authenticated Vaultwarden user who has been invited to an organization with the Owner role and has accepted that invite, placing membership in the Accepted (not yet Confirmed) state; from there a single POST /api/ciphers/purge call against that organization triggers the flaw. Limiting factors: the attacker cannot self-elevate to Owner-an existing owner or admin must first issue the owner invitation, so the flaw is only reachable where owner invites are extended to untrusted parties (e.g., multi-tenant or shared hosting). Confirmation is NOT required, which is precisely the bug; affected only on versions < 1.35.5. |
| Impact | Signals are consistent and point to a genuine but not urgent integrity/availability issue rather than a mass-exploitation event. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:H, 8.1 High) reflects network reachability, low complexity, and only low privileges (an accepted org-owner invite) with no user interaction, and high integrity/availability impact via destructive deletion but no confidentiality loss. EPSS is very low (0.04%, 11th percentile) and CISA SSVC lists Exploitation: none, Automatable: no, Technical Impact: partial-so there is no evidence of active or automatable exploitation. The one meaningful precondition (attacker must receive and accept an organization-owner invite) limits opportunistic use, making this most relevant to multi-tenant or shared Vaultwarden deployments where owner invitations are issued. No conflicting signals of note, though the input 'Hashicorp' tag appears to be mislabeled and should be disregarded (this is Vaultwarden, not HashiCorp Vault). |
| Exploit ScenarioDerived | An attacker obtains an organization-owner invitation (for example on a shared or multi-tenant Vaultwarden instance) and accepts it, reaching the Accepted state without waiting for an existing owner to confirm them. From that state they send an authenticated POST /api/ciphers/purge request, which passes the type-only Owner check and hard-deletes all ciphers and attachments in the organization. No public proof-of-concept is identified at time of analysis, but the low-complexity, no-interaction nature makes reproduction straightforward once an owner invite is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Improper authorization in Vaultwarden (self-hosted Bitwarden-compatible server) before 1.35.5 lets an authenticated user who was invited as an organization owner and has accepted-but not yet been confirmed-invoke POST /api/ciphers/purge to hard-delete every cipher and attachment in the organization. The endpoint checks only that membership type is Owner and omits the required Confirmed-status check, enabling irreversible organization-wide data loss. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and SSVC records no known exploitation.
RemediationAI
Vendor-released patch: upgrade to Vaultwarden 1.35.5 or later, which adds the missing Confirmed-status check on the purge path; this is the primary and complete fix per advisory GHSA-937x-3j8m-7w7p (https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-937x-3j8m-7w7p). Until the upgrade is applied, reduce exposure by not issuing organization-owner invitations (or promptly confirming/revoking pending owner invites so no account lingers in the Accepted-but-unconfirmed state), and treat unexpected pending owner invites as suspicious; on multi-tenant instances restrict who can create organizations and issue owner invites. As a safety net against the irreversible hard-delete, ensure current, tested backups of the Vaultwarden data store so an org-wide purge can be recovered-note this mitigates impact but does not prevent the deletion itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vaultwarden is a lightweight Rust reimplementation of the Bitwarden server API, widely self-hosted as a password/secrets vault. The flaw is a CWE-863 Incorrect Authorization: the organization invite lifecycle has three states (Invited → Accepted → Confirmed), where accepting an invite only proves the user acted on it, and a separate confirmation by an existing owner is what actually grants trusted access. The purge handler builds authorization from plain request Headers and gates solely on membership type Owner, never asserting membership status Confirmed. As a result, the intermediate Accepted-but-unconfirmed state-intended to be powerless-retains destructive owner capability. The single affected package is cpe:2.3:a:dani-garcia:vaultwarden.
Know when Vaultwarden gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network endpoint, low complexity, requires an accepted org-owner invite so PR:L; destructive hard-delete gives I:H/A:H with no data disclosure (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions membership from Invited to Accepted, and a separate confirmation by an existing owner upgrades it to Confirmed. The POST /api/ciphers/purge endpoint uses plain Headers and only checks that the membership type is Owner without verifying that the membership status is Confirmed. An authenticated user who has been invited as an organization owner and has accepted the invite and has not yet been confirmed can call this endpoint to hard-delete all ciphers and attachments in the organization, causing immediate organization-wide data loss. This vulnerability is fixed in 1.35.5.
Executive ViewAI
Vaultwarden versions before 1.35.5 contain an authorization bypass that allows unconfirmed organization owners to permanently delete all stored ciphers and attachments, resulting in complete and irreversible loss of the organization's password vault data. This affects all self-hosted Bitwarden-compatible deployments and represents a critical data integrity risk requiring immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Vaultwarden
View allTwo-factor authentication bypass in Vaultwarden 1.34.3 and earlier allows authenticated attackers to circumvent 2FA prot
Vaultwarden before 1.35.4 exposes a password-validity oracle at /api/two-factor/send-email-login when server-side email
Cross-organization authorization bypass in Vaultwarden (the Rust-based, self-hosted Bitwarden-compatible server) prior t
Vaultwarden through 1.37.3 permits authenticated users who hold a revoked or not-yet-confirmed organization membership t
Session hijacking via a broken SSO/OAuth authorization flow affects Vaultwarden (the Rust-based Bitwarden-compatible ser
Vaultwarden versions prior to 1.35.4 fail to properly enforce collection management permissions, allowing authenticated
Vaultwarden versions before 1.35.4 contain a privilege escalation vulnerability that allows authenticated Manager-level
Session persistence in Vaultwarden 1.35.4 and earlier lets a stolen refresh token outlive the account-hardening steps a
Authentication bypass (account takeover) in Vaultwarden before 1.36.0 allows an attacker who controls a federated identi
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Rated high sev
Vaultwarden's SSO discovery endpoint exposed real organization SSO metadata - including organizationIdentifier values -
Vaultwarden versions prior to 1.35.3 allow authenticated organization members to bypass collection-level access controls
Exploit-DB