CVE-2026-26012
Analyzed Analyzed - Analysis Complete
Unauthorized Access in Vaultwarden Allows Organization-Wide Cipher Disclosure

Publication date: 2026-02-11

Last updated on: 2026-02-13

Assigner: GitHub, Inc.

Description
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to 1.35.3, a regular organization member can retrieve all ciphers within an organization, regardless of collection permissions. The endpoint /ciphers/organization-details is accessible to any organization member and internally uses Cipher::find_by_org to retrieve all ciphers. These ciphers are returned with CipherSyncType::Organization without enforcing collection-level access control. This vulnerability is fixed in 1.35.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-11
Last Modified
2026-02-13
Generated
2026-06-16
AI Q&A
2026-02-12
EPSS Evaluated
2026-06-15
NVD
CVE-2026-26012
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
dani-garcia vaultwarden to 1.35.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in vaultwarden, an unofficial Bitwarden compatible server. Prior to version 1.35.3, any regular organization member could retrieve all stored ciphers within the organization, regardless of the permissions set on individual collections. This happens because the endpoint /ciphers/organization-details is accessible to all organization members and internally retrieves all ciphers without enforcing collection-level access control. As a result, sensitive data meant to be restricted to certain collections could be accessed by unauthorized members.

Impact Analysis

The vulnerability allows unauthorized organization members to access all stored ciphers, potentially exposing sensitive credentials or secrets that should be restricted. This can lead to confidentiality breaches, as attackers or unauthorized users within the organization can view sensitive information without proper permissions.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade vaultwarden to version 1.35.3 or later, where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart