CVE-2026-26012 in vaultwarden
Summary
by MITRE • 02/12/2026
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/12/2026
This vulnerability exists in vaultwarden, an unofficial Bitwarden compatible server implementation written in Rust that was previously known as bitwarden_rs. The flaw represents a critical access control bypass that allows regular organization members to retrieve all ciphers within an organization regardless of their collection permissions. The vulnerability stems from the /ciphers/organization-details endpoint which is accessible to any organization member and internally utilizes the Cipher::find_by_org function to retrieve all ciphers without proper access control enforcement. This endpoint returns ciphers with CipherSyncType::Organization type but fails to validate collection-level permissions that should normally restrict access to specific cipher collections based on user roles and assigned permissions. The issue affects versions prior to 1.35.3 and represents a significant security gap that violates fundamental principles of least privilege and role-based access control. Organizations using vaultwarden may experience unauthorized data exposure when regular members can access ciphers they should not be permitted to view based on their assigned collections and permissions.
The technical implementation flaw occurs within the cipher retrieval logic where the system retrieves all organization ciphers without validating whether the requesting user has proper authorization to access each specific cipher. This bypasses the intended collection-based access control mechanisms that should restrict users to only view ciphers within their assigned collections. The vulnerability is categorized under CWE-284 Access Control Bypass, which specifically addresses insufficient access control mechanisms that allow unauthorized users to access resources they should not be permitted to access. This represents a classic privilege escalation vulnerability where regular users gain elevated access beyond their intended permissions. The flaw demonstrates a failure in the application's authorization logic where the system assumes that organization membership alone should grant access to all organization data, ignoring the more granular collection-level permissions that should govern access to specific cipher content.
The operational impact of this vulnerability is severe as it allows any regular organization member to potentially access sensitive information that should be restricted to specific users or groups within the organization. This could lead to unauthorized data exposure, compliance violations, and potential data breaches when confidential information such as passwords, credit card details, or other sensitive credentials becomes accessible to users who should not have such broad access. The vulnerability affects the core functionality of the organization's security model by undermining the intended collection-based access controls that are fundamental to maintaining data segregation and confidentiality. Organizations may face regulatory penalties and security audit failures when this vulnerability is exploited, as it demonstrates a failure to implement proper access control mechanisms that should be standard in enterprise security solutions. The impact extends beyond simple information disclosure to potentially enable further attacks through the exposure of sensitive credential information that could be used for lateral movement within the organization.
Organizations using vaultwarden should immediately upgrade to version 1.35.3 or later to remediate this vulnerability and ensure proper access control enforcement. The fix implemented in version 1.35.3 addresses the core issue by enforcing collection-level access control when retrieving organization ciphers through the /ciphers/organization-details endpoint. Security teams should conduct immediate audits of their vaultwarden deployments to verify that all instances have been updated to the patched version. Additional mitigations include implementing network-level restrictions to limit access to the /ciphers/organization-details endpoint, monitoring for unauthorized access attempts, and reviewing organization membership and collection assignments to ensure proper access control policies are in place. Organizations should also consider implementing additional security controls such as multi-factor authentication for administrative accounts and regular security assessments to identify similar access control vulnerabilities. This vulnerability aligns with ATT&CK technique T1078 Valid Accounts, as it exploits legitimate user accounts to gain unauthorized access to organization data, and T1566 Phishing, as the vulnerability could be exploited through social engineering to gain initial access before leveraging the privilege escalation. The fix demonstrates the importance of proper authorization checking in multi-tenant applications and the critical need for implementing granular access controls that respect user roles and permissions.