Medium WID-SEC-2026-0398 1 CVE

Vaultwarden: Schwachstelle ermöglicht Offenlegung von Informationen

Published Feb 11, 2026 · Updated Feb 11, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Vaultwarden ausnutzen, um Informationen offenzulegen.

Product

Vaultwarden ist eine alternative Implementierung der Server API des Bitwarden Passwort-Managers.

Vulnerabilities 1

Medium 6.5

CVE-2026-26012 Public exploit

vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphe…

dani-garcia vaultwarden

Feb 11, 2026

Revision history

2026-02-11 #1
Initiale Fassung

References

Red Hat Bugtracker vom 2026-02-11
https://bugzilla.redhat.com/show_bug.cgi?id=2439184
GitHub Advisory Database vom 2026-02-11
https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337