CVSS 3.1
8.3 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LCVE-2026-27803
High (8.3) in dani-garcia vaultwarden. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in vaultwarden 1.35.4.
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-269, CWE-285, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dani-garcia:vaultwarden
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h4hq-rgvh-wh27 | crates.io | vaultwarden | <1.35.4 | 1.35.4 |