CVE-2026-27898

Received Received - Intake

Insecure Direct Object Reference in Vaultwarden Cipher Update API

Publication date: 2026-03-04

Last updated on: 2026-03-06

Assigner: GitHub, Inc.

Description

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user’s cipher_id and call "PUT /api/ciphers/{id}/partial" Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). This issue has been patched in version 1.35.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-04

Last Modified

2026-03-06

Generated

2026-07-06

AI Q&A

2026-03-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27898

EUVD

EUVD-2026-9504

Affected Vendors & Products

Vendor	Product	Version / Range
dani-garcia	vaultwarden	to 1.35.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Vaultwarden, an unofficial Bitwarden compatible server. Before version 1.35.4, an authenticated regular user could specify another user's cipher_id and use the "PUT /api/ciphers/{id}/partial" endpoint. Although the standard retrieval API correctly denies access to that cipher, this partial update endpoint incorrectly returns a 200 OK response and exposes sensitive cipher details such as name, notes, data, and secureNote.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information stored in other users' ciphers. An attacker with authenticated access could view confidential data like names, notes, and secure notes of other users, potentially leading to privacy breaches and data leakage.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Vaultwarden to version 1.35.4 or later, where the issue has been patched.

Hi! I’m here to help you understand CVE-2026-27898. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70