CVE-2026-27803 - Vulnerability Analysis

Overview

Vaultwarden prior to 1.35.4 contains a broken access control vulnerability caused by improper enforcement of manager permissions on collections, letting managers perform unauthorized management operations, exploit requires manager role with access to the collection.

Severity & Score

Impact

Managers can perform unauthorized management operations on collections, potentially leading to privilege escalation or data manipulation.

Mitigation

Update to version 1.35.4 or later.

References

• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner