CVE-2026-27802

Received Received - Intake

Privilege Escalation in Vaultwarden via Bulk Permission Update

Publication date: 2026-03-04

Last updated on: 2026-03-06

Assigner: GitHub, Inc.

Description

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. This issue has been patched in version 1.35.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-04

Last Modified

2026-03-06

Generated

2026-07-06

AI Q&A

2026-03-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27802

EUVD

EUVD-2026-9502

Affected Vendors & Products

Vendor	Product	Version / Range
dani-garcia	vaultwarden	to 1.35.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Vaultwarden, an unofficial Bitwarden compatible server. Before version 1.35.4, a user with Manager privileges could escalate their privileges by performing a bulk permission update on collections they are not authorized to access. This means that a Manager could gain unauthorized access or control over collections they should not have permission to manage.

Impact Analysis

The vulnerability allows a user with Manager privileges to escalate their access rights improperly, potentially gaining unauthorized access to sensitive collections. This can lead to exposure, modification, or deletion of confidential data stored within those collections, compromising confidentiality, integrity, and availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this privilege escalation vulnerability in Vaultwarden, you should upgrade your Vaultwarden server to version 1.35.4 or later, where the issue has been patched.

Hi! I’m here to help you understand CVE-2026-27802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70