CVE-2026-26012

Katalog CVE

CVSS 6.5 · Medium EPSS 0,41%

Kerentanan Incorrect Authorization pada dani-garcia vaultwarden. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.

Rincian

Terbit di NVD

11 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337 advisory vendor
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.3 product · release notes