CVE-2026-26012: vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::findbyorg to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26012?
CVE-2026-26012 has a severity rating that can pose significant risks to data confidentiality within organizations using affected versions of vaultwarden.
How do I fix CVE-2026-26012?
To patch CVE-2026-26012, upgrade vaultwarden to version 1.35.3 or later.
What does CVE-2026-26012 affect?
CVE-2026-26012 affects vaultwarden versions prior to 1.35.3, allowing unauthorized access to ciphers within an organization.
Who is affected by CVE-2026-26012?
Organizations using vaultwarden versions below 1.35.3, particularly those with regular members, are affected by CVE-2026-26012.
What is the impact of CVE-2026-26012?
The impact of CVE-2026-26012 is that it allows regular organization members to retrieve all ciphers without permission checks.