CVE-2026-95814: Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in getusercollectionsaccessflags, getgroupcollectionsaccessflags, and isinfullaccessgroup to access protected cipher data server-side.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Vaultwarden deployments through 1.37.3 are exposed where organization members have been revoked or are pending confirmation and could previously access organization ciphers. The issue affects access determined through organization collections or full-access groups.
What does an attacker need to exploit it?
An attacker needs revoked or not-yet-confirmed membership in the target organization. No user interaction is required, and the attacker can use the missing status checks to access organization cipher data server-side.
What actions can a revoked or pending member perform?
They may retain read, write, delete, and attachment access to protected organization ciphers when access is granted through the affected collection or group queries.