Vaultwarden CVE-2026-95814

The attacker must possess a Vaultwarden account that holds a non-confirmed relationship to a target organization - specifically a REVOKED membership (previously granted, then removed) or a PENDING/not-yet-confirmed invitation - because the leftover users_collections and groups_users rows are what the missing status filter fails to exclude. This is not unauthenticated (PR:L): the attacker needs credentials and a prior membership linkage to the org's collections or full-access groups. Limiting factors: it only affects organizations that use collection- or group-based cipher sharing, and only users who were at some point invited to or members of that org; a wholly external user with no org relationship cannot exploit it. Fixed by upgrading past 1.37.3 (PR #7554).

This is a genuine, credible authorization-bypass (CWE-863) with a coherent signal set rather than an inflated high-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, 8.6) is internally consistent with the description: network-reachable, low complexity, requires low privilege (the attacker must already hold a - revoked or pending - account/membership relationship), no user interaction, and high confidentiality and integrity impact (read, write, delete, attachment access) with no availability impact. The source-code diff in PR #7554 corroborates the mechanism precisely: three queries (get_user_collections_access_flags, get_group_collections_access_flags, is_in_full_access_group) failed to filter on MembershipStatus::Confirmed, and the fix adds that filter/join - so root cause is confirmed, not inferred. No EPSS score, no CISA KEV entry, and no public exploit are present in the input, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The absence of KEV/EPSS should not be read as low risk here: exploitation is conceptually trivial for anyone who was ever invited to or removed from an org, and the fix diff effectively documents the vulnerable code paths, lowering the bar to weaponization. Priority is driven by impact and ease, not by observed exploitation.

An employee who was removed (revoked) from a Vaultwarden organization, or a user who was invited but has not yet confirmed membership, continues sending normal API requests for organization ciphers. Because the server never checks membership status in the affected queries, it returns and accepts read/write/delete/attachment operations on protected org secrets the attacker should no longer (or not yet) be able to reach. No public PoC is provided, but the patch diff clearly identifies the three vulnerable queries.