CVE-2026-26012 - Vulnerability Analysis

Overview

Vaultwarden prior to 1.35.3 contains an information disclosure vulnerability caused by lack of collection-level access control in /ciphers/organization-details endpoint, letting regular organization members retrieve all organization ciphers, exploit requires organization membership.

Severity & Score

Impact

Regular organization members can access all organization ciphers, exposing sensitive data beyond their permissions.

Mitigation

Update to version 1.35.3 or later.

References

• https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.3
• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337

Social Media Activity(1 post)

benzogaga33 :verified:

@benzogaga33

Feb 13, 2026

Vaultwarden – CVE-2026-26012 : cette faille expose vos mots de passe aux autres utilisateurs ! https://www.it-connect.fr/vaultwarden-cve-2026-26012-cette-faille-expose-vos-mots-de-passe-aux-autres-utilisateurs/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

View original post

GitHub Repositories(1 repo)

• https://github.com/Dulieno/CVE-2026-26012

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner