CVE-2026-27803 — Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given co…
Published: 2026-03-04 · CVSS: 8.3 · CVSS 3.1
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7