CVE-2026-27803

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

State: Published
Severity: 8.3 High
Published: Mar 4, 2026
Updated: Mar 5, 2026
Reserved: Feb 24, 2026

Description

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	GitHub_M

Weaknesses

CWE-269 Improper Privilege Management
CWE-863 Incorrect Authorization
CWE-285 Improper Authorization

Affected Products

Product	Versions
vaultwardendani-garcia	< 1.35.4Affected

References

https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.