CVE-2026-33420: Vaultwarden missing authorization check allows Manager-role users to enumerate all collections
Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the getorgcollectionsdetails endpoint (GET /api/organizations/{orgid}/collections/details) is missing the hasfullaccess() authorization check that exists on the sibling getorgcollections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve the names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. This issue has been fixed in version 1.35.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vaultwardento a version that resolves this vulnerability.Fixed in 1.35.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33420?
CVE-2026-33420 has a high severity due to its potential for unauthorized data enumeration by Manager-role users.
How do I fix CVE-2026-33420?
To fix CVE-2026-33420, upgrade Vaultwarden to version 1.35.5 or later where the vulnerability is addressed.
What specific endpoint is affected by CVE-2026-33420?
CVE-2026-33420 affects the get_org_collections_details endpoint, specifically the GET /api/organizations/{org_id}/collections/details.
Who is impacted by CVE-2026-33420?
Users with Manager-role privileges in Vaultwarden versions 1.35.4 and earlier are impacted by CVE-2026-33420.
Can CVE-2026-33420 be exploited remotely?
Yes, CVE-2026-33420 can be exploited remotely by users with Manager-role permissions without proper authentication checks.