Skip to content
OpenAdvisories
High WID-SEC-2026-0594 4 CVEs

Vaultwarden: Mehrere Schwachstellen

Published Mar 4, 2026 · Updated Mar 4, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Privilegien zu erlangen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.

Product

Vaultwarden ist eine alternative Implementierung der Server API des Bitwarden Passwort-Managers.

Vulnerabilities 4

  • High 8.3
    CVE-2026-27802

    Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

    Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. This issue has …

    dani-garcia vaultwarden vaultwarden crates.io
  • High 8.3
    CVE-2026-27803

    Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

    Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they hav…

    dani-garcia vaultwarden vaultwarden crates.io
  • Medium 6.0
    CVE-2026-27801

    Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

    Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a …

    dani-garcia vaultwarden vaultwarden crates.io
  • Medium 5.4
    CVE-2026-27898

    Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher

    Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user’s cipher_id and call "PUT /api/ciphers/{id}/partial" Even though the stan…

    dani-garcia vaultwarden vaultwarden crates.io

Revision history

  1. #1

    Initiale Fassung

References