CVE-2026-27802 — Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability …
Published: 2026-03-04 · CVSS: 8.3 · CVSS 3.1
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. This issue has been patched in version 1.35.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7