CVE-2026-43913 - Vulnerability Analysis

Overview

Vaultwarden prior to 1.35.5 contains a broken access control vulnerability caused by insufficient verification of organization owner confirmation status in the POST /api/ciphers/purge endpoint, letting authenticated unconfirmed organization owners purge all organization vault data, exploit requires authenticated invited organization owner.

Severity & Score

Impact

Authenticated unconfirmed organization owners can delete all organization vault data, causing complete data loss for the organization.

Mitigation

Update to version 1.35.5 or later.

References

• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-937x-3j8m-7w7p

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner