CVE-2026-27803CWE-269CWE-285CWE-863

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

High · published March 4, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-285 · Improper Authorization; CWE-863 · Incorrect Authorization
Published
2026-03-04T21:40Z
EPSS history
Timeline
  • 04 MAR 21:40Z
    Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role
    cvelistv5