EUVD-2026-274633

fkie_cve-2026-27803

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

GHSA-h4hq-rgvh-wh27 — Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

Affected: crates.io: vaultwarden

## Summary

Testing confirmed that even when a Manager has `manage=false` for a given collection, they can still perform the following management operations as long as they have access to the collection:

* `PUT /api/organizations/<org_id>/collections/<col_id>` succeeds (HTTP 200) * `PUT /api/organizations/<org_id>/collections/<col_id>/users` succeeds (HTTP 200) * `DELETE /api/organizations/<org_id>/collections/<col_id>` succeeds (HTTP 200)

## Description

* The Manager guard checks only whether the user **can access the collection**, not whether they have `manage` privileges. This check is directly applied to management endpoints. src/auth.rs:816 ```rust

if !Collection::can_access_collection(&headers.membership, &col_id, &conn).await { err_handler!("The current user isn't a manager for this collection") } ```

* The `can_access_collection` function does **not** evaluate the `manage` flag. src/db/models/collection.rs:140

```rust

pub async fn can_access_collection(member: &Membership, col_id: &CollectionId, conn: &DbConn) -> bool { member.has_status(MembershipStatus::Confirmed) && (member.has_full_access() || CollectionUser::has_access_to_collection_by_user(col_id, &member.user_uuid, conn).await || ... ```

* A separate management-permission check exists and includes `manage` validation, but it is **not used** during authorization for the affected endpoints. src/db/models/collection.rs:516

```rust…

WID-SEC-W-2026-0594 — Vaultwarden: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Privilegien zu erlangen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.

Most recent entries from all

EUVD-2026-274633

fkie_cve-2026-27803

GHSA-h4hq-rgvh-wh27 — Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

WID-SEC-W-2026-0594 — Vaultwarden: Mehrere Schwachstellen