Most recent entries from all

EUVD-2026-274632

fkie_cve-2026-27898

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular user can specify another user’s cipher_id and call "PUT /api/ciphers/{id}/partial" Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns 200 OK and exposes cipherDetails (including name, notes, data, secureNote, etc.). This issue has been patched in version 1.35.4.

GHSA-w9f8-m526-h7fh — Vaultwarden has Unauthorized Access via Partial Update API on Another User’s Cipher

Affected: crates.io: vaultwarden

## Summary

In the test environment, it was confirmed that an authenticated regular user can specify another user’s `cipher_id` and call:

``` PUT /api/ciphers/{id}/partial ```

Even though the standard retrieval API correctly denies access to that cipher, the partial update endpoint returns **200 OK** and exposes `cipherDetails` (including `name`, `notes`, `data`, `secureNote`, etc.).

## Description

`put_cipher_partial` retrieves the target Cipher but does **not perform ownership or access control checks** before returning `to_json`. Authorization checks present in the normal update API are missing here. src/api/core/ciphers.rs:717

```rust let Some(cipher) = Cipher::find_by_uuid(&cipher_id, &conn).await else { err!("Cipher doesn't exist") };

if let Some(ref folder_id) = data.folder_id { if Folder::find_by_uuid_and_user(folder_id, &headers.user.uuid, &conn).await.is_none() { err!("Invalid folder", "Folder does not exist or belongs to another user"); } }

// Move cipher cipher.move_to_folder(data.folder_id.clone(), &headers.user.uuid, &conn).await?;

// Update favorite cipher.set_favorite(Some(data.favorite), &headers.user.uuid, &conn).await?;

Ok(Json(cipher.to_json(&headers.host, &headers.user.uuid, None, CipherSyncType::User, &conn).await?)) ```

By comparison, the standard update API includes an explicit authorization check: src/api/core/ciphers.rs:688

```rust if !cipher.is_write_accessible_to_user(&headers.user.uuid, &conn).await { err!("Ci…

WID-SEC-W-2026-0594 — Vaultwarden: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Privilegien zu erlangen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.