CVE-2026-95814 in Vaultwarden
Summary
by MITRE • 09/22/2026
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group to access protected cipher data server-side.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Vaultwarden versions through 1.37.3 represents a critical authorization failure within the application's organization management subsystem. This flaw stems from an omission of proper membership status validation during specific API queries that determine user and group access permissions for organizational ciphers. In secure identity and access management systems, it is imperative that any request to retrieve or modify sensitive data be accompanied by rigorous checks against the current state of the requester’s account within the organization. Vaultwarden failed to enforce this principle in three distinct code paths responsible for calculating collection access flags and verifying full access group membership. Consequently, individuals whose accounts have been revoked due to termination or suspension, as well as those who are pending confirmation after an invitation has been sent but not yet accepted, were incorrectly granted the same level of access as active members. This oversight allows unauthorized entities to interact with protected cipher data on the server side, bypassing intended security controls that should restrict such interactions based on membership status.
From a technical perspective, the vulnerability resides in three specific functions: get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group. These functions are designed to evaluate whether a user or group has permission to read, write, delete, or access attachments associated with organization ciphers. The core defect lies in the absence of filters that check for revoked or unconfirmed status before returning these permissions. When an attacker exploits this flaw, they can manipulate API requests to retrieve sensitive information such as login credentials, secure notes, and attached files belonging to other users within the same organization. Because Vaultwarden operates as a self-hosted password manager often used by enterprises and teams with strict data governance requirements, the ability of revoked or pending members to access this data constitutes a severe breach of confidentiality. The attacker does not need to compromise user credentials directly; instead, they leverage valid session tokens associated with accounts that should have been restricted but were not properly filtered out during permission evaluation.
The operational impact of this vulnerability is significant for any organization relying on Vaultwarden for secure collaboration. Revoked members typically retain active sessions or API keys until explicit logout procedures are completed by the system administrator, providing a window of opportunity for exploitation. Similarly, pending users may have limited access but should not possess full organizational privileges. The ability to read, write, delete, and download attachments means that an attacker can exfiltrate sensitive corporate data, alter critical records such as banking credentials or intellectual property documents, or destroy evidence by deleting cipher entries. This undermines the integrity and availability of the password vault service while exposing confidential information to unauthorized parties. For organizations subject to regulatory compliance frameworks like GDPR, HIPAA, or SOC 2, this vulnerability represents a significant control failure that could lead to data breaches and subsequent legal or financial repercussions.
In terms of industry standards, this flaw aligns with CWE-862, which describes Missing Authorization, as the application failed to enforce proper access controls on sensitive resources. It also relates closely to CWE-290, Authentication Bypass by Spoofing, in the context that pending users are treated as fully authenticated and authorized members despite lacking final confirmation of their identity or intent. Furthermore, from an adversary perspective, this vulnerability facilitates techniques categorized under MITRE ATT&CK T1530, Data from Cloud Storage Objects, where attackers access data stored in cloud-based services without proper authorization. The exploitation path involves leveraging existing valid sessions to query internal APIs that should have returned empty results or error codes for unauthorized users but instead provided full access flags.
To mitigate this vulnerability, organizations running Vaultwarden must immediately upgrade to version 1.37.4 or later, where the missing status validation has been implemented in the affected functions. Until an update can be applied, administrators should enforce strict session management policies by ensuring that all users are forcibly logged out when their membership is revoked or canceled. Additionally, reviewing API key permissions and restricting access to sensitive endpoints for pending accounts can reduce the attack surface. Regular audits of user memberships and active sessions will help identify any lingering unauthorized access attempts. It is also recommended to enable comprehensive logging on the Vaultwarden instance to monitor for unusual patterns in cipher access requests that may indicate exploitation of this flaw, allowing for rapid detection and response to potential data exfiltration events.